{"containers": {"cna": {"affected": [{"product": "bot", "vendor": "python-discord", "versions": [{"status": "affected", "version": "< 67390298852513d13e0213870e50fb3cff1424e0"}]}], "descriptions": [{"lang": "en", "value": "Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-11-05T22:45:11", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/python-discord/bot/commit/67390298852513d13e0213870e50fb3cff1424e0"}], "source": {"advisory": "GHSA-j8c3-8x46-8pp6", "discovery": "UNKNOWN"}, "title": "Presence of non-blacklisted URL bypasses all other filters", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-41250", "STATE": "PUBLIC", "TITLE": "Presence of non-blacklisted URL bypasses all other filters"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "bot", "version": {"version_data": [{"version_value": "< 67390298852513d13e0213870e50fb3cff1424e0"}]}}]}, "vendor_name": "python-discord"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0"}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20: Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6", "refsource": "CONFIRM", "url": "https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6"}, {"name": "https://github.com/python-discord/bot/commit/67390298852513d13e0213870e50fb3cff1424e0", "refsource": "MISC", "url": "https://github.com/python-discord/bot/commit/67390298852513d13e0213870e50fb3cff1424e0"}]}, "source": {"advisory": "GHSA-j8c3-8x46-8pp6", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:08:31.640Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/python-discord/bot/commit/67390298852513d13e0213870e50fb3cff1424e0"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-41250", "datePublished": "2021-11-05T22:45:11", "dateReserved": "2021-09-15T00:00:00", "dateUpdated": "2024-08-04T03:08:31.640Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pythondiscord:bot:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CFA9C9B-6454-4D0A-BC9D-8ADCE00E2BFA", "versionEndExcluding": "67390298852513d13e0213870e50fb3cff1424e0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0"}, {"lang": "es", "value": "Python discord bot es el bot de la comunidad de Python Discord. En las versiones afectadas, cuando es incluido en el mismo mensaje una URL que no est\u00e1 en la lista negra y un token de filtro que de otro modo ser\u00eda desencadenado, el filtro de token no es desencadenado. Esto significa que al incluir cualquier URL que no est\u00e9 en la lista negra es posible omitir los filtros de moderaci\u00f3n. Este problema ha sido resuelto en el commit 67390298852513d13e0213870e50fb3cff1424e0"}], "id": "CVE-2021-41250", "lastModified": "2023-07-17T15:17:05.420", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-11-05T23:15:08.790", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/python-discord/bot/commit/67390298852513d13e0213870e50fb3cff1424e0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}