CVE-2022-21669
Bot token exposed in main.py
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.1EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
11 Jan 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
PuddingBot · pudding-botWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →