SB2025020538 - Multiple vulnerabilities in Discourse

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Origin validation error (CVE-ID: CVE-2024-55948)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the cache poisoning issue within XHR requests. A remote attacker can use a specially crafted XHR request to poison the anonymous cache.

2) Origin validation error (CVE-ID: CVE-2025-23023)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the cache poisoning issue within request headers. A remote attacker can use a specially crafted request with the right request headers to poison the anonymous cache.

Remediation

Install update from vendor's website.

References

• https://github.com/discourse/discourse/security/advisories/GHSA-2352-252q-qc82
• https://github.com/discourse/discourse/security/advisories/GHSA-5h4h-2f46-r3c7