CVE-2021-41250 Presence of non-blacklisted URL bypasses all other filters
Attackers can bypass moderation filters by including a non-blacklisted URL in messages containing triggering tokens, allowing prohibited content to be posted.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41250?
CVE-2021-41250 is a medium-severity vulnerability in python-discord bot, published on 5 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0
Weakness: CWE-20
Which versions are affected by CVE-2021-41250?
It affects 1 product.
Products include Pythondiscord Bot.
How do I fix CVE-2021-41250?
No fix has been published for CVE-2021-41250 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-41250 being exploited?
There is no known exploitation of CVE-2021-41250 in the wild and no public exploit code.
Sources
Also known as GHSA-j8c3-8x46-8pp6.