Cache Poisoning Vulnerability in Discourse by Discourse
CVE-2025-23023

8.2HIGH

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
4 February 2025

What is CVE-2025-23023?

In Discourse, a widely used open-source community discussion platform, a cache poisoning vulnerability allows an attacker to craft malicious requests aimed at manipulating the anonymous cache. This manipulation can lead to responses that lack essential preloaded data, affecting the experience of anonymous visitors. To mitigate this issue, users are strongly encouraged to update to the latest version of Discourse. For those unable to perform the upgrade, it is advisable to disable the anonymous cache by configuring the DISCOURSE_DISABLE_ANON_CACHE environment variable appropriately.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

discourse stable: < 3.3.2 < stable: 3.3.2

discourse tests-passed: < 3.4.0.beta3 < tests-passed: 3.4.0.beta3

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.