Auth bypass in Dav-Cogs Project
CVE-2021-32646
Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the ``manage channel`` permissions in a private VC they have joined. This allowed them to make changes to or delete the voice channel they have taken over. The exploit does not allow access or control to any other channels in the server. Upgrade to version 1.0.1 for a patched version of the cog. As a workaround you may disable private VCs in your guild(server) or unload the roomer cog to render the exploit unusable.
Vulnerability class: Broken Authentication
EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Dav-cogs_project Dav-cogs
- Dav-git Dav-cogs — versions < 1.0.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-32646?
- CVE-2021-32646 is a medium-severity vulnerability in Dav-Cogs Project, classified under Improper Authentication. CVSS score: 5.3/10. Published 2021-05-28.
- How severe is CVE-2021-32646?
- Medium severity. CVSS v3 base score is 5.3 out of 10.