Cache Poisoning Vulnerability in Discourse by Discourse
CVE-2025-23023

8.2HIGH

Key Information:

Vendor
Discourse
Status
Discourse
Vendor
CVE Published:
4 February 2025

Summary

In Discourse, a widely used open-source community discussion platform, a cache poisoning vulnerability allows an attacker to craft malicious requests aimed at manipulating the anonymous cache. This manipulation can lead to responses that lack essential preloaded data, affecting the experience of anonymous visitors. To mitigate this issue, users are strongly encouraged to update to the latest version of Discourse. For those unable to perform the upgrade, it is advisable to disable the anonymous cache by configuring the DISCOURSE_DISABLE_ANON_CACHE environment variable appropriately.

Affected Version(s)

discourse stable: < 3.3.2 < stable: 3.3.2

discourse tests-passed: < 3.4.0.beta3 < tests-passed: 3.4.0.beta3

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.