PT-2019-14237
CVE-2019-15515
·
Published
2019-08-26
·
Updated
2019-08-29
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Discourse version 2.3.2
Description
The issue involves Discourse sending the CSRF token in the query string, which could potentially be exploited.
Recommendations
For Discourse version 2.3.2, consider updating to a newer version that does not send the CSRF token in the query string, or as a temporary workaround, restrict access to sensitive operations that rely on the CSRF token.
Found an issue in the description? Have something to add? Feel free to write us 👾