{"id":"CVE-2022-39302","summary":"Ree6 may bypass webhook protection","details":"Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as \"Better-Audit-Logging\" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements. This issue has been patched in version 1.9.9. There are currently no known workarounds.","aliases":["GHSA-v574-xgcf-5w8x"],"modified":"2026-08-12T13:33:14.454802Z","published":"2022-10-13T00:00:00Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39302.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39302.json"},{"type":"ADVISORY","url":"https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-v574-xgcf-5w8x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39302"},{"type":"FIX","url":"https://github.com/Ree6-Applications/Ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ree6-applications/ree6","events":[{"introduced":"0"},{"fixed":"de53736d4c2f1455dd256dd2f8676bdffda399b2"},{"fixed":"459b5bc24f0ea27e50031f563373926e94b9aa0a"}],"database_specific":{"cpe":"cpe:2.3:a:ree6:ree6:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.9.9"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["1.9.8","1.9.7.1","1.9.7","1.9.6","1.9.5","1.9.4","1.9.3","1.9.2","1.9.0","1.8.0","1.7.20","1.7.19","1.7.18","1.7.15","1.7.14","1.7.13","1.7.12","1.7.11","1.7.10","1.7.9","1.7.8","1.7.7","1.7.6","1.7.5","1.7.4","1.7.3","1.7.2","1.7.1","1.7.0","1.6.4","1.6.3","1.6.0","1.5.3","1.5.2","1.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39302.json","vanir_signatures_modified":"2026-08-12T13:33:14Z","vanir_signatures":[{"source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/TwitchNotifier.java"},"deprecated":false,"digest":{"line_hashes":["313934829252519182549187485154860487907","337646543617430303164884781612934552983","83361408074759716182058334512352603331","38741853098254215143213310150140799316"],"threshold":0.9},"id":"CVE-2022-39302-09e4c766","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"318421365048449509809275934429858660262","length":1721},"id":"CVE-2022-39302-11bc7057","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"function":"onPerform","file":"src/main/java/de/presti/ree6/commands/impl/mod/EmbedSender.java"}},{"deprecated":false,"digest":{"line_hashes":["161098007183349397167615582190516370872","104794186496873810925304538322019779414","108925151227594105225412585736411665713","319992535407508407413743030116893991450"],"threshold":0.9},"id":"CVE-2022-39302-16ff06ca","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/YouTubeNotifier.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["254731765814266511228253385236702724093","274697680470733591084909035989185375457","320599367484295299326057133421505339191","134663092134429176585071037436690763446"]},"id":"CVE-2022-39302-1aff6bbc","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/InstagramNotifier.java"}},{"target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/TwitterNotifier.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["32076956789955829677599298176968717668","282843714222765122873233574506251149997","234663658134733887811859712546339723867","176489599634371025967108340298281690218"]},"id":"CVE-2022-39302-1ca2d3b2","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a"},{"signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/InstagramNotifier.java","function":"onPerform"},"deprecated":false,"digest":{"function_hash":"30774906766372468294538318486786336308","length":4671},"id":"CVE-2022-39302-2468730b","signature_type":"Function"},{"source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/TwitterNotifier.java","function":"onPerform"},"deprecated":false,"digest":{"function_hash":"185811439547848901541849705497839453738","length":4651},"id":"CVE-2022-39302-3548299f","signature_type":"Function","signature_version":"v1"},{"digest":{"length":90,"function_hash":"20712446925385009035174374967041199677"},"id":"CVE-2022-39302-35bbc65f","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/sql/entities/webhook/WebhookNews.java","function":"WebhookNews"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"4373080591595171220886826005876476777","length":16},"id":"CVE-2022-39302-3ec91216","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"function":"WebhookNews","file":"src/main/java/de/presti/ree6/sql/entities/webhook/WebhookNews.java"}},{"signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/sql/SQLWorker.java","function":"isNewsSetup"},"deprecated":false,"digest":{"length":136,"function_hash":"221014725705110318134766612351179379171"},"id":"CVE-2022-39302-4525f14e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"79415283334641185659457489313977909523","length":837},"id":"CVE-2022-39302-4d4d8be2","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/events/OtherEvents.java","function":"sendDefaultChoice"}},{"deprecated":false,"digest":{"line_hashes":["66260871620623999454100732883549698304","286180350690281177811882384198726168489","227939565267350190663900192868425919363","211998803542841900571288372909102964763"],"threshold":0.9},"id":"CVE-2022-39302-4df55e41","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/mod/Setup.java"}},{"target":{"file":"src/main/java/de/presti/ree6/events/OtherEvents.java","function":"onSelectMenuInteraction"},"deprecated":false,"digest":{"function_hash":"4446876675465948975364582122872062178","length":18593},"id":"CVE-2022-39302-537a80a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a"},{"id":"CVE-2022-39302-59003079","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/sql/entities/webhook/WebhookNews.java"},"deprecated":false,"digest":{"line_hashes":["177040834172634512160983598708875465618","84803239319392217060170900520596143152","160732307848753569118677279167660722595","245517802130946126482811979423445538173","230444539590464885203145740904472570967","241285993534594436930691871327061731372","298442116106123189169579626008554258846"],"threshold":0.9}},{"source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/mod/Import.java","function":"onPerform"},"deprecated":false,"digest":{"function_hash":"95844039833151047926763546965527834849","length":439},"id":"CVE-2022-39302-6f932b3c","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/java/de/presti/ree6/commands/impl/mod/Import.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["264305592700630558559318905297857320535","206360692139844225793699349716906321465","249568050634334352284706901249351282856","36623324613681721566550428805369155599","10212211122334517806029778807165441445","1753498168239707402829024786275709756","103946037290912971061456903003273701542","187599378546589304496413039181181650230"]},"id":"CVE-2022-39302-81960fc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a"},{"deprecated":false,"digest":{"line_hashes":["2436792351229145426868200397247498224","259214451442843707115398736868206322350","136035682134443319912312261294698839884","10269023365465274978506290099548621435"],"threshold":0.9},"id":"CVE-2022-39302-85df0f74","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/RedditNotifier.java"}},{"digest":{"function_hash":"80134285871223098044082995967527650729","length":4582},"id":"CVE-2022-39302-9d5a8f78","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/TwitchNotifier.java","function":"onPerform"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/sql/SQLWorker.java","function":"getNewsWebhook"},"deprecated":false,"digest":{"function_hash":"107084715364941002384433754328743240337","length":192},"id":"CVE-2022-39302-a846c652"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/mod/Setup.java","function":"onPerform"},"deprecated":false,"digest":{"function_hash":"15217340522423685332387068317322939226","length":1515},"id":"CVE-2022-39302-a973e153"},{"digest":{"length":4616,"function_hash":"64612112411019963476121962149097501790"},"id":"CVE-2022-39302-cd19133b","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/RedditNotifier.java","function":"onPerform"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/events/OtherEvents.java"},"deprecated":false,"digest":{"line_hashes":["21716244525446335191377217550920848375","297442766154745320786590332378902193369","316824771516298680610460002163970624667","141122246615229357866844033821829877418","95177950898570055034346588619661740495","139084622370899971932403811741390367112","103176185667239545937017370287938647778","335075669155002391029552249175091828209","225059916038918965988203792234209410259","142568360649134755036033089680980934303","310840297658031081060963585744409385956","154546941714841725716815196135325692015","225805982494988155450565114401322667545","878290766911915099998701494829317437","100698994625727064337331203748294202039","173093590843307841619134853666530066186","70045120913497210840160558665154387154","143327668965166614727006352254090379924","77465637649182821907624575588982988568","121473817155940035609818179954895036033","254531916745990148018339547317991031702","49133097571068854310862332620424979199","4170834102393583544781961697796033625","27539114115461453694637411642218776843","49821635945691688642050045006876422673","273406697602393359572585300698082228692","140719793062498850689868553911139986458","163174712502972304325628013426528529700","281989292145875178165278837786587719018","146175905717150439464203292502854272016","241567404433413741773616621020469569988","107248738905583130665264006480815594472","95272568665267419451131704983486968841","151767582035955107803577670471373423055","178116192649145314314037422937431026240","247859510507857062215673087718528453981","152660180407291363097230918136050907289","196904051104030921968292279278241702335","79568650202458489499174323362625456032","251242808842623591080712343038777304","170083750963115800082539343016018744922","214427936314015704737300204052953411459","121473817155940035609818179954895036033","15860672528563935557595013041174237454","11892742316927214910042414871975989594","186602958308730315448856948638619865762","191670946581622937258112361854697792198","176277092995282346002959292206253776805","263949710486764490574070354837609176564","193825357033204212436345196033056343709","207395153328854371819250590272166294856","191807936707805369455741139813664189518","36011908453481871476749639386704430846","129793207207447846861265860346980313370","335954623361914270915476435599786343216","159821648214060413654846452142895062092","153629025942961315036833286858887983190","250193241784412968139594633861401315987","68702530488504800149223137187485998581","66260871620623999454100732883549698304","286180350690281177811882384198726168489","227939565267350190663900192868425919363","211998803542841900571288372909102964763"],"threshold":0.9},"id":"CVE-2022-39302-d1c83feb","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/sql/SQLWorker.java","function":"setNewsWebhook"},"deprecated":false,"digest":{"function_hash":"278283775668388308090694714373624328636","length":675},"id":"CVE-2022-39302-d711412c","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/mod/EmbedSender.java"},"deprecated":false,"digest":{"line_hashes":["32299836422835033450119547780452271243","194814391109026422242710731694123109288","8346943065170897148253757493591623606","158522851804403583272506706645227728595","180534080633689358647983908972215326922","127362146082316270609089124308300311292","38505456191798093328276524510745131220"],"threshold":0.9},"id":"CVE-2022-39302-d89995e8"},{"source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/commands/impl/community/YouTubeNotifier.java","function":"onPerform"},"deprecated":false,"digest":{"function_hash":"271190567599072093903023905011916599144","length":4641},"id":"CVE-2022-39302-e72aebe7","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/ree6-applications/ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a","target":{"file":"src/main/java/de/presti/ree6/sql/SQLWorker.java"},"deprecated":false,"digest":{"line_hashes":["78904718435732303390088336659677699132","7808822821835954561968711626036565580","45864330489024605088199993995792153238","324092782855088010100703441694463709454","334388936964394563536071526478386228121","109840257845635508108708113796588590410","70105127737104893296640690612423400431","206214441862144957286677416224551539088","74091175527597379076759081491998255045","290900305561563003200910160900035064364","18743372024124113650254963578119821689","26510891987703716833414168438437699039","203146689642027346906492548535191384916","73124567830087403865075885642111501471","227301862085053259088754059900871244704","171087820517582871710712361021889549363","328509601814985772288584497990536455256","106511739870329999117732076638537882516","20285842331079628362300237091597967824","179335662288416016270957501192272450430","291243522169947596023374876541662811005"],"threshold":0.9},"id":"CVE-2022-39302-ebada069","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["158633684928765415560519087926667377525","83070585019615912945495474252236584550","219299433723211354946701397294601481710","158465640071739564268455620391324433578","300133477810291819532717898083050128685","103523385467933307077441035152172608153","221739695120422749629806788374658323317","154443857777896382438569692869799486033"],"threshold":0.9},"id":"CVE-2022-39302-f606fb14","signature_type":"Line","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/de53736d4c2f1455dd256dd2f8676bdffda399b2","target":{"file":"src/main/java/de/presti/ree6/main/Main.java"}},{"id":"CVE-2022-39302-fa10daf1","signature_type":"Function","signature_version":"v1","source":"https://github.com/ree6-applications/ree6/commit/de53736d4c2f1455dd256dd2f8676bdffda399b2","target":{"function":"main","file":"src/main/java/de/presti/ree6/main/Main.java"},"deprecated":false,"digest":{"function_hash":"279480961113466240303420068404447931161","length":3617}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"}]}