by Kastro
Paper/Archive/CVE-2022-21669

CVE-2022-21669

PuddingBot pudding-bot — Bot token exposed in main.py

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 63.8.638 × 2012.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.

Affected

ProductAffectedFixed inSource
pudding-bot<= 0.0.6-b933652–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/PuddingBot/pudding-bot/security/advisories/GHSA-cxgr-xpmj-9qjmrefgithub.com/PuddingBot/pudding-bot/commit/a5b15fb0a5be5fdbacba8ff7b2c8759d5e3ba20f