PT-2021-18256 · Unknown · Red Discord Bot+1

Dav-Git · Published 2021-05-10 · Updated 2022-10-25 · CVE-2021-29501

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Ticketer cog versions prior to 1.0.1

Description: A vulnerability has been found in the Ticketer cog, a command-based ticket system plugin for the red Discord bot, allowing Discord users to expose sensitive information.

Recommendations: For versions prior to 1.0.1, upgrade to version 1.0.1 as soon as possible. As a temporary workaround, consider unloading the Ticketer cog to disable the exploitable code.

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2021-29501

GHSA-R2CF-49R7-PFJ7

Affected Products

Ticketer Cog

Red Discord Bot

References · 4

• https://github.com/Dav-Git/Dav-Cogs/commit/3d54ef9b52ce03f139b7d6c1cc38c375e65593fd · Patch
• https://osv.dev/vulnerability/CVE-2021-29501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29501 · Security Note
• https://github.com/Dav-Git/Dav-Cogs/security/advisories/GHSA-r2cf-49r7-pfj7 · Note