CVE-2024-23654CWE-918

discourse-ai admin-initiated SSRF when interacting with AI services

Medium · published February 21, 2024

CVSS v3.1
4.1
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with different AI services are vulnerable to admin-initiated SSRF attacks. Versions of the plugin that include commit 94ba0dadc2cf38e8f81c3936974c167219878edd contain a patch. As a workaround, one may disable the discourse-ai plugin.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-02-21T20:28Z
EPSS history
Timeline
  • 21 FEB 20:28Z
    discourse-ai admin-initiated SSRF when interacting with AI services
    cvelistv5