PT-2024-28723 · Unknown · Red Discord Bot

Flame442 + 1 · Published 2024-07-11 · Updated 2024-07-11 · CVE-2024-39905

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Red-DiscordBot versions prior to 3.5.10

Description A bug in Red's Core API may authorize a user to run a command even when that user doesn't have permissions to manage a channel. This issue affects 3rd-party cogs using the @commands.can manage channel() command permission check without additional permission controls. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any public 3rd-party cog utilizing this API at the time of writing this advisory.

Recommendations For versions prior to 3.5.10, update to version 3.5.10 to resolve the issue. As a temporary workaround, consider unloading any cog using the @commands.can manage channel() command permission check until an upgrade to a patched version can be performed.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-39905

GHSA-5JQ8-Q6RJ-9GQ4

Affected Products

Red Discord Bot

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39905.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39905 · Security Note
• https://osv.dev/vulnerability/GHSA-5jq8-q6rj-9gq4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39905 · Vendor Advisory
• https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4 · Note
• https://github.com/Cog-Creators/Red-DiscordBot/pull/6398 · Note
• https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750 · Note
• https://github.com/Cog-Creators/Red-DiscordBot · Note
• https://t.me/cvedetector/662 · Telegram Post
• https://twitter.com/CVEnew/status/1811428033120665898 · Twitter Post