PT-2022-12904 · Premid · Premid

Rxri · Published 2022-02-20 · Updated 2022-07-12 · CVE-2021-46701

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions PreMiD version 2.2.0

Description The issue allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord.

Recommendations For PreMiD version 2.2.0, consider disabling the websocket transport as a temporary workaround until a patch is available. Restrict access to the websocket endpoint to minimize the risk of exploitation. Avoid using the vulnerable websocket transport in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2021-46701

Affected Products

Premid

References · 5

• 🔥 https://github.com/PreMiD/PreMiD/issues/790 · Exploit
• https://github.com/PreMiD/PreMiD/pull/791 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46701 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46701 · Vendor Advisory
• https://t.me/cvenotify/27110 · Telegram Post