PT-2021-18254 · Unknown · Kennnyshiwa-Cogs

Flame442 · Published 2021-05-06 · Updated 2023-11-06 · CVE-2021-29493

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: kennnyshiwa-cogs versions prior to 5a84d60018468e5c0346f7ee74b2b4650a6dade7

Description: A remote code execution (RCE) exploit has been found in the Tickets module of kennnyshiwa-cogs, allowing Discord users to craft a message that can reveal sensitive and harmful information.

Recommendations: For versions prior to 5a84d60018468e5c0346f7ee74b2b4650a6dade7, upgrade to version 5a84d60018468e5c0346f7ee74b2b4650a6dade7 to receive a patch. As a temporary workaround, consider unloading the tickets module to render the exploit unusable.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-29493

GHSA-F4J2-2CWR-H473

Affected Products

Kennnyshiwa-Cogs

References · 5

• https://github.com/kennnyshiwa/kennnyshiwa-cogs/security/advisories/GHSA-f4j2-2cwr-h473 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29493 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29493 · Vendor Advisory
• https://github.com/kennnyshiwa/kennnyshiwa-cogs/commit/5a84d60018468e5c0346f7ee74b2b4650a6dade7 · Note
• https://t.me/cvenotify/14183 · Telegram Post