CVE-2021-41191

2021-10-2721:15:08

Google

osv.dev

roblox-purchasing-hub

security risk

version 1.0.2

api url

product files

api key

workaround

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

49.2%

JSON

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone’s API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @require_apikey in BOT/lib/cogs/website.py under the route for /v1/products.