Vulnerability · Published Feb 15, 2022 · Assigned by GitHub_M

CVE-2022-23604Privilege escalation in Defender

High 8.8

In plain English

A high-severity privilege mismanagement in x26-Cogs from Twentysix26. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.1%top 33.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.

Affected products (as reported)

Vendor	Product	Versions
Twentysix26	x26-Cogs	< 1.10.0

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Twentysix26/x26-Cogs/security/advisories/GHSA-cfh8-v56j-5757 x_refsource_CONFIRM
https://github.com/Twentysix26/x26-Cogs/commit/72dd9323cb4c90f3a5accac7087605375d178246 x_refsource_MISC
https://github.com/Twentysix26/x26-Cogs/releases/tag/v1.10 x_refsource_MISC