VYPR
← All advisories
Medium severity4.1NVD Advisory· Published Feb 21, 2024· Updated Jun 17, 2026

CVE-2024-23654

CVE-2024-23654

Description

discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with different AI services are vulnerable to admin-initiated SSRF attacks. Versions of the plugin that include commit 94ba0dadc2cf38e8f81c3936974c167219878edd contain a patch. As a workaround, one may disable the discourse-ai plugin.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Discourse (software)/AI
    cpe:2.3:a:discourse:ai:*:*:*:*:*:*:*:*
    Range: <2024-02-21
  • Discourse (software)/Discourse AIllm-fuzzy2 versions
    <94ba0dadc2cf38e8f81c3936974c167219878edd+ 1 more
    • (no CPE)range: <94ba0dadc2cf38e8f81c3936974c167219878edd
    • (no CPE)range: < 94ba0dadc2cf38e8f81c3936974c167219878edd

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.