{"id":"CVE-2024-39905","published":"2024-07-11T15:43:34Z","modified":"2024-08-02T04:33:11Z","title":"Red-DiscordBot vulnerable to Incorrect Authorization in commands API","vendor":"Cog-Creators","product":"Red-DiscordBot","tier":"tail","description":{"text":"Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00413,"percentile":0.35515,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Cog-Creators/Red-DiscordBot/pull/6398","tags":["x_refsource_MISC"]},{"url":"https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750","tags":["x_refsource_MISC"]}],"priority":{"score":10.8,"factors":[{"name":"EPSS percentile","points":7.1},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"cog-creators","affectedVersions":[{"vendor":"Cog-Creators","product":"Red-DiscordBot","versions":[">= 3.5.0, < 3.5.10"]}],"affected":[{"ecosystem":"PyPI","package":"Red-DiscordBot","vulnerableRanges":[">=3.5.0, <3.5.10"],"patched":["3.5.10"],"from":["GHSA-5jq8-q6rj-9gq4","PYSEC-2026-1865"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2269","exploited":false,"provenance":"source"}}