PT-2021-23164 · Roblox · Roblox-Purchasing-Hub

Highparker02311 · Published 2021-10-27 · Updated 2021-11-02 · CVE-2021-41191

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roblox-Purchasing-Hub versions 1.0.1 and prior

Description A security risk in Roblox-Purchasing-Hub allowed individuals with access to someone's API URL to obtain product files without an API key.

Recommendations For versions 1.0.1 and prior, update to version 1.0.2 to resolve the issue. As a temporary workaround for versions 1.0.1 and prior, consider adding @require apikey in BOT/lib/cogs/website.py under the route for "/v1/products".

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2021-41191

GHSA-76MX-6584-4V8Q

Affected Products

Roblox-Purchasing-Hub

References · 7

• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41191 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41191 · Vendor Advisory
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2 · Note
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8q · Note
• https://t.me/cvenotify/22879 · Telegram Post
• https://t.me/cibsecurity/31332 · Telegram Post