PT-2022-23123 · Pypi · Py-Cord

Bobdotcom + 1 · Published 2022-08-18 · Updated 2022-12-09 · CVE-2022-36024

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions py-cord version 2.0.0

Description The issue affects py-cord, a Python API wrapper for Discord, allowing remote shutdown of bots if they are added to a server with the application.commands scope without the bot scope. It appears that all public bots using slash commands are affected.

Recommendations For version 2.0.0, upgrade to version 2.0.1 to resolve the issue. As a temporary workaround, consider avoiding the addition of bots to servers with the application.commands scope without the bot scope until a patch is applied. There are currently no other recommended workarounds.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2022-36024

GHSA-QMHJ-M29V-GVMR

PYSEC-2022-43146

Affected Products

Py-Cord

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36024.json · Exploit
• https://github.com/Pycord-Development/pycord/pull/1568 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36024 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-43146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qmhj-m29v-gvmr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36024 · Vendor Advisory
• https://github.com/Pycord-Development/pycord/security/advisories/GHSA-qmhj-m29v-gvmr · Note
• https://github.com/Pycord-Development/pycord · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/py-cord/PYSEC-2022-43146.yaml · Note
• https://t.me/cibsecurity/48358 · Telegram Post