PT-2022-16119 · Unknown · X26-Cogs Defender Cog

Published 2022-02-15 · Updated 2022-02-24 · CVE-2022-23604

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions x26-Cogs Defender cog versions prior to 1.10.0

Description A vulnerability in the Defender cog allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider unloading the Defender cog until the patch is applied.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-23604

GHSA-CFH8-V56J-5757

Affected Products

X26-Cogs Defender Cog

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23604.json · Exploit
• https://github.com/Twentysix26/x26-Cogs/commit/72dd9323cb4c90f3a5accac7087605375d178246 · Patch
• https://osv.dev/vulnerability/CVE-2022-23604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23604 · Security Note
• https://github.com/Twentysix26/x26-Cogs/security/advisories/GHSA-cfh8-v56j-5757 · Note
• https://github.com/Twentysix26/x26-Cogs/releases/tag/v1.10 · Note
• https://t.me/cibsecurity/37503 · Telegram Post