Loading...
Skip to main content
GeekWala

CVE-2022-24849 — Vulnerability in DisCatSharp — CVE Details

MEDIUM

Exposure of Sensitive Information to an Unauthorized Actor in DisCatSharp

Published April 22, 2022Updated November 8, 2023Source: osv

Summary

### Impact Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two `RequireDisCatSharpDeveloperAttribute`s or the `BaseDiscordClient.LibraryDeveloperTeam` have potentially had their bot token sent to a web server not affiliated with Discord. This server is owned and operated by DisCatSharp's development team. The tokens were not logged, yet it is still advisable to reset the tokens of potentially affected bots. ### Patches 9.9.1 has been released to patch the issue for the current stable release and the current 10.0.0 prereleases are also no longer affected. ### Workarounds Remove all uses of the two `RequireDisCatSharpDeveloperAttribute`s and all direct calls to `BaseDiscordClient.LibraryDeveloperTeam`. ### Details The `HttpClient` responsible for sending requests to the Discord API was erroneously reused to send requests to our website when DisCatSharp's team members were to be fetched. ### For more information If you have any questions or comments about this advisory: * Join our [Discord server](https://discord.gg/GGYSywkxwN) * Email us at [ottero@aitsys.dev](mailto:ottero@aitsys.dev)

Advisory Timeline

  • First published April 22, 2022 (1634 days ago).
  • Last revised November 8, 2023 — 564 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update DisCatSharp to 9.9.1 or later
dotnet add package DisCatSharp --version 9.9.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: nuget (1).

PackageEcosystemAffectedFixed In
DisCatSharp
nuget
9.8.5, 9.8.6, 9.8.6-nightly-00261, 9.8.6-nightly-00262 (+20 more)9.9.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-200
    Information ExposureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2022-24849?
Exposure of Sensitive Information to an Unauthorized Actor in DisCatSharp This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2022-24849?
CVE-2022-24849 affects DisCatSharp. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-24849 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-frxg-hf44-q765

Related CVEs

  • CVE-2017-0249
    HIGH

    High severity vulnerability that affects Microsoft.AspNetCore.Mvc

  • CVE-2026-106111
    MEDIUM

    ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

  • CVE-2026-65829
    MEDIUM

    MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies