{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-35237 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-35237 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-35237 is a high-severity missing authorization vulnerability in ZelnickB mit-identibot, published on 27 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-35237 and fix it if it is affected.\n\nWhat it is: CVE-2024-35237 is a high-severity missing authorization vulnerability in ZelnickB mit-identibot, published on 27 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-35237 in the wild and no public exploit code.\n\nAffected product: ZelnickB mit-identibot. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-35237/ (Markdown: https://insights.sbomify.com/CVE-2024-35237/index.md)","id":"CVE-2024-35237","markdown":"https://insights.sbomify.com/CVE-2024-35237/index.md","name":"CVE-2024-35237","record":{"aliases":["GHSA-h8r9-7r8x-78v6"],"analysis":{"component_type":"other","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Discord bot","requires_auth":"none","summary":"Unauthenticated users can access private MIT affiliation data via Discord commands if the bot is added to a public server without authorization checks.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a \"public\" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To prevent exploitation of the vulnerability, all vulnerable instances of IdentiBot should be taken offline until they have been updated.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"MIT IdentiBot User-Kerberos Mapping Publicly Available","id":"CVE-2024-35237","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2024"},"n_packages":0,"n_references":2,"next":{"headline":"Denial of service of Minder Server from maliciously crafted GitHub attestations","id":"CVE-2024-35238"},"packages":[],"prev":{"headline":"Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks","id":"CVE-2024-35236"},"products":["mit-identibot"],"published":"2024-05-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["ZelnickB"]},"summary":"Unauthenticated users can access private MIT affiliation data via Discord commands if the bot is added to a public server without authorization checks.","url":"https://insights.sbomify.com/CVE-2024-35237/"}