CVE-2021-32632 CSRF allowing modification of commands, modules, banphrases through hidden iFrames
Attackers can force authenticated users to modify bot commands, modules, and banphrases via hidden iframes, requiring hosters to upgrade.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-32632?
CVE-2021-32632 is a low-severity vulnerability in pajbot, published on 20 May 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should upgrade to `v1.52` or `stable` to install the patch or, as a workaround, can add one modern dependency.
Weakness: CWE-352
Which versions are affected by CVE-2021-32632?
It affects 1 product.
Products include Pajbot Pajbot.
How do I fix CVE-2021-32632?
No fix has been published for CVE-2021-32632 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32632 being exploited?
There is no known exploitation of CVE-2021-32632 in the wild and no public exploit code.
Sources
Also known as GHSA-wmfr-qrg4-qc3h.