CVE-2024-39905CWE-863

Red-DiscordBot vulnerable to Incorrect Authorization in commands API

Medium · published July 11, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-07-11T15:43Z
EPSS history
Timeline
  • 11 JUL 15:43Z
    Red-DiscordBot vulnerable to Incorrect Authorization in commands API
    cvelistv5