Vulnerabilities > Discourse > Discourse > 2.3.2

DATE CVE VULNERABILITY TITLE RISK
2021-01-14 CVE-2021-3138 Improper Restriction of Excessive Authentication Attempts vulnerability in Discourse
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
network
low complexity
discourse CWE-307
5.0
5.0
2019-08-26 CVE-2019-15515 Cross-Site Request Forgery (CSRF) vulnerability in Discourse 2.3.2
Discourse 2.3.2 sends the CSRF token in the query string.
network
discourse CWE-352
4.3
4.3