CVE-2023-22452

CVSS V2 None CVSS V3 None
Description
kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.
Overview
  • CVE ID
  • CVE-2023-22452
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-02T20:15:10
  • Last Modified Date
  • 2023-01-09T19:53:15
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:kenny2automate_project:kenny2automate:*:*:*:*:*:*:*:* 1 OR a947d7c
References
Reference URL Reference Tags
https://github.com/Kenny2github/kenny2automate/commit/a947d7ce408687b587c7e6dfd6026f7c4ee31ac2
https://github.com/Kenny2github/kenny2automate/security/advisories/GHSA-73j8-xrcr-q6j7
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-22452
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22452
History
Created Old Value New Value Data Type Notes
2023-01-02 21:14:21 Added to TrackCVE
2023-01-02 21:14:22 Weakness Enumeration new
2023-01-03 14:13:36 2023-01-03T13:26:34 CVE Modified Date updated
2023-01-03 14:13:36 Received Awaiting Analysis Vulnerability Status updated
2023-01-06 16:20:22 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-09 20:19:56 2023-01-09T19:53:15 CVE Modified Date updated
2023-01-09 20:19:56 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-09 20:19:59 CPE Information updated