Vulnerability · Published May 10, 2021 · Assigned by GitHub_M

CVE-2021-29502Remote code execution in the WarnSystem module of Laggrons-Dumb-Cogs

High 7.3

In plain English

A high-severity injection in Laggrons-Dumb-Cogs from retke. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.8%top 42.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type `!warnsysteminfo` to check that their version is 1.3.18 or above. As a workaround users may unload the WarnSystem cog or disable the `!warnset description` command globally.

Affected products (as reported)

Vendor	Product	Versions
retke	Laggrons-Dumb-Cogs	< 1.3.18

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/retke/Laggrons-Dumb-Cogs/security/advisories/GHSA-834g-67vv-m9wq x_refsource_CONFIRM
https://github.com/retke/Laggrons-Dumb-Cogs/commit/c79dd2cc879989cf2018e76ba2aad0baef3b4ec8 x_refsource_MISC