Vulnerability · Published Jan 11, 2022 · Assigned by GitHub_M
CVE-2022-21669Bot token exposed in main.py
Critical 9.1
In plain English
A critical-severity hard-coded credentials in pudding-bot from PuddingBot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PuddingBot | pudding-bot | <= 0.0.6-b933652 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N