PT-2021-19828 · Roomer · Roomer

Dav-Git · Published 2021-05-28 · Updated 2022-07-02 · CVE-2021-32646

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Roomer versions prior to 1.0.1

Description A vulnerability has been discovered in the Roomer discord bot cog, allowing discord users to gain manage channel permissions in a private voice channel they have joined. This enables them to make changes to or delete the voice channel. The exploit is limited to the voice channel they have taken over and does not provide access or control to other channels in the server.

Recommendations For versions prior to 1.0.1, upgrade to version 1.0.1 for a patched version of the cog. As a temporary workaround, consider disabling private VCs in your guild (server) or unloading the Roomer cog to render the exploit unusable.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-32646

GHSA-3F73-8J6Q-28V8

Affected Products

Roomer

References · 4

• https://github.com/Dav-Git/Dav-Cogs/security/advisories/GHSA-3f73-8j6q-28v8 · Patch
• https://github.com/Dav-Git/Dav-Cogs/commit/fbe2ae8ec851a2e9e3e2370db3b812f268e8c8cb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32646 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32646 · Vendor Advisory