CVE-2022-23604

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-236052.3Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were noCVE-2022-236066.5Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery ServCVE-2022-236076.5treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) CVE-2022-236089.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDCVE-2022-236099.1iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly saCVE-2022-23614.8The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users sCVE-2022-236108.1wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it waCVE-2022-236119.8iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly saCVE-2022-236127.5OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. AffectedCVE-2022-236137.8xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesCVE-2022-236149.8Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avCVE-2022-236155.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with
CVE-2022-23604: High severity, CVSS 7.2 | Vulnix