Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2024-21624

Medium
6.5/10

Summary

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential Information Leak (e.g., environment variables) in instances where developers utilize "MessageTemplate" and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request 2509. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template. This issue affects the versions 2.0.0a16 through 2.1.3.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published