Impact
What kind of vulnerability is it? Who is impacted?
A vulnerability has been discovered allowing discord users to get the manage channel permissions in a private VC they have joined. This allowed them to make changes to or delete the voice channel they have taken over. The exploit does not allow access or control to any other channels in the server.
Patches
Has the problem been patched? What versions should users upgrade to?
Upgrade to version 1.0.1 for a patched version of the cog.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Disable private VCs in your guild(server) or unload the roomer cog to render the exploit unusable.
References
Are there any links users can visit to find out more?
Commit fbe2ae8
Repository Dav-Git/Dav-Cogs
For more information
If you have any questions or comments about this advisory:
Impact
What kind of vulnerability is it? Who is impacted?
A vulnerability has been discovered allowing discord users to get the
manage channelpermissions in a private VC they have joined. This allowed them to make changes to or delete the voice channel they have taken over. The exploit does not allow access or control to any other channels in the server.Patches
Has the problem been patched? What versions should users upgrade to?
Upgrade to version 1.0.1 for a patched version of the cog.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Disable private VCs in your guild(server) or unload the roomer cog to render the exploit unusable.
References
Are there any links users can visit to find out more?
Commit fbe2ae8
Repository Dav-Git/Dav-Cogs
For more information
If you have any questions or comments about this advisory: