Read the docs
TI-2023-08702 Aliases CVE-2023-22452

Improper Input Validation in kenny2automate

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kenny2githubkenny2automate< a947d7c—No fix listedCNA
  • kenny2automate VendorKenny2github Affected < a947d7c Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kenny2automate_project:kenny2automate:*:*:*:*:*:*:*:*before a947d7cVulnerableKenny2automate Project
  • cpe:2.3:a:kenny2automate_project:kenny2automate:*:*:*:*:*:*:*:* Versions before a947d7c Vulnerable ·Kenny2automate Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22452

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences