CVE-2023-22452

kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.

• CWE-20

• https://github.com/Kenny2github/kenny2automate/commit/a947d7ce408687b587c7e6dfd6026f7c4ee31ac2Patch, Third Party Advisory
• https://github.com/Kenny2github/kenny2automate/security/advisories/GHSA-73j8-xrcr-q6j7Patch, Third Party Advisory
• https://github.com/Kenny2github/kenny2automate/commit/a947d7ce408687b587c7e6dfd6026f7c4ee31ac2Patch, Third Party Advisory
• https://github.com/Kenny2github/kenny2automate/security/advisories/GHSA-73j8-xrcr-q6j7Patch, Third Party Advisory

Published

Jan 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22447Insertion of sensitive information into log file in the Open…4.4
• CVE-2023-22448Improper access control for some Intel Unison software may a…7.2
• CVE-2023-22449Improper input validation in some Intel(R) NUC BIOS firmware…6.7
• CVE-2023-2245A vulnerability was found in hansunCMS 1.4.3. It has been de…6.3
• CVE-2023-22450 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an…7.2
• CVE-2023-22451Kiwi TCMS is an open source test management system. In versi…8.8
• CVE-2023-22453Discourse is an option source discussion platform. Prior to …5.3
• CVE-2023-22454Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22455Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22456ViewVC, a browser interface for CVS and Subversion version c…6.1
• CVE-2023-22457CKEditor Integration UI adds support for editing wiki pages …8.8
• CVE-2023-22458Redis is an in-memory database that persists on disk. Authen…5.5