CVEvulnerability

CVE-2022-36024

6.5 MEDIUM Published 2022-08-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-284, CWE-862

Description

py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the `application.commands` scope without the `bot` scope. Currently, it appears that all public bots that use slash commands are affected. This issue has been patched in version 2.0.1. There are currently no recommended workarounds - please upgrade to a patched version.

Affected configurations

• pycord development pycord 2.0.0

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-862 Missing Authorization weakness

References