PT-2022-24885 · Ree6 · Ree6

Dxssucuk · Published 2022-10-13 · Updated 2022-10-17 · CVE-2022-39302

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ree6 versions prior to 1.9.9

Description This issue allows other server owners to create configurations that contain a channel from another server as a target, enabling the sending of log messages to another Guild channel and bypassing raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements.

Recommendations For versions prior to 1.9.9, update to version 1.9.9 to resolve the issue. As a temporary workaround, consider restricting the use of the "Better-Audit-Logging" configuration to minimize the risk of exploitation. Avoid using configurations that contain channels from other servers as targets until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-39302

GHSA-V574-XGCF-5W8X

Affected Products

Ree6

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39302.json · Exploit
• https://github.com/Ree6-Applications/Ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a · Patch
• https://osv.dev/vulnerability/CVE-2022-39302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39302 · Security Note
• https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-v574-xgcf-5w8x · Note
• https://t.me/cibsecurity/51388 · Telegram Post