CVE-2022-23604 Privilege escalation in Defender
Server admins can execute bot-owner restricted commands by impersonating other users, requiring an upgrade to the Defender cog.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23604?
CVE-2022-23604 is a high-severity vulnerability in Twentysix26 x26-Cogs, published on 15 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.
Weakness: CWE-269
Which versions are affected by CVE-2022-23604?
It affects 1 product.
Products include X26-Cogs Project X26-Cogs.
How do I fix CVE-2022-23604?
No fix has been published for CVE-2022-23604 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-23604 being exploited?
There is no known exploitation of CVE-2022-23604 in the wild and no public exploit code.
Sources
Also known as GHSA-cfh8-v56j-5757.