« Volver al listado

CVE-2024-39905

Estado: AplazadaMedia (5.3)—

Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Red-discord-bot — REDAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39905",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39905",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-12T18:05:25.225801Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Cog-Creators",
          "product": "Red-DiscordBot",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.5.0, < 3.5.10"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:cogboard:red_discord_bot:3.5.0:*:*:*:*:*:*:*"
          ],
          "vendor": "cogboard",
          "product": "red_discord_bot",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.0",
              "lessThan": "3.5.10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-11T16:15:05.067",
  "references": [
    {
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/pull/6398",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/pull/6398",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10."
    },
    {
      "lang": "es",
      "value": "Red es un bot de Discord totalmente modular. Debido a un error en la API principal de Red, los engranajes de terceros que utilizan la verificación de permisos del comando `@commands.can_manage_channel()` sin controles de permisos adicionales pueden autorizar a un usuario a ejecutar un comando incluso cuando ese usuario no tiene permisos para administrar un canal. Ninguno de los comandos principales o engranajes principales se ve afectado. Los mantenedores del proyecto no tienen conocimiento de ningún any _public_ 3rd-party que utilice esta API al momento de escribir este aviso. El problema fue parcheado y lanzado en la versión 3.5.10. "
    }
  ],
  "lastModified": "2026-06-17T07:42:59.967",
  "sourceIdentifier": "security-advisories@github.com"
}