PT-2024-21294 · Unknown · Electroncord

Kedi · Published 2024-02-20 · Updated 2025-02-05 · CVE-2024-26136

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ElectronCord (affected versions not specified)

Description ElectronCord is a bot management tool for Discord. A commit exposes an account access token in the config.json file. Malicious actors could potentially exploit this to gain unauthorized access to sensitive information or perform malicious actions on behalf of the repository owner. It is unknown whether the owner of the repository has rotated the token or taken other mitigation steps aside from informing users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-26136

GHSA-PPWC-5VWP-MHW8

Affected Products

Electroncord

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26136.json · Exploit
• https://github.com/kedi/ElectronCord/security/advisories/GHSA-ppwc-5vwp-mhw8 · Vendor Advisory
• https://github.com/kedi/ElectronCord/commit/aaaeaf4e6c99893827b2eea4dd02f755e1e24041 · Patch
• https://osv.dev/vulnerability/CVE-2024-26136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26136 · Security Note
• https://twitter.com/cracbot/status/1760182656791376300 · Twitter Post
• https://t.me/cvenotify/110187 · Telegram Post
• https://twitter.com/CVEnew/status/1760071862946848916 · Twitter Post
• https://t.me/cvenotify/72250 · Telegram Post