CVE-2022-23604

x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/Twentysix26/x26-Cogs/commit/72dd9323cb4c90f3a5accac7087605375d178246	Patch Third Party Advisory
https://github.com/Twentysix26/x26-Cogs/releases/tag/v1.10	Release Notes Third Party Advisory
https://github.com/Twentysix26/x26-Cogs/security/advisories/GHSA-cfh8-v56j-5757	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:x26-cogs_project:x26-cogs:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-02-15 16:15

Updated : 2022-02-24 02:26

NVD link : CVE-2022-23604

Mitre link : CVE-2022-23604

CVE.ORG link : CVE-2022-23604

JSON object : View

Products Affected

x26-cogs_project

x26-cogs

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2022-23604", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-02-15T16:15:09.000", "references": [{"url": "https://github.com/Twentysix26/x26-Cogs/commit/72dd9323cb4c90f3a5accac7087605375d178246", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Twentysix26/x26-Cogs/releases/tag/v1.10", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Twentysix26/x26-Cogs/security/advisories/GHSA-cfh8-v56j-5757", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround."}, {"lang": "es", "value": "x26-Cogs es un repositorio de cogs hecho por Twentysix para el bot Red Discord. Entre estos engranajes es encontrado el engranaje Defender, una herramienta para la moderaci\u00f3n del servidor de Discord. Una vulnerabilidad en Defender cog versiones anteriores a 1.10.0, permite a usuarios con privilegios de administrador emitir comandos como otros usuarios que comparten el mismo servidor. Si el propietario de un bot comparte el mismo servidor que el atacante, es posible que \u00e9ste emita comandos restringidos al propietario del bot. El problema ha sido parcheado en versi\u00f3n 1.10.0. Puede descargarse el engranaje Defender como medida de mitigaci\u00f3n"}], "lastModified": "2022-02-24T02:26:05.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x26-cogs_project:x26-cogs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0244BB5C-D961-4BD3-AB3E-7E7448F414BA", "versionEndExcluding": "1.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}