Remote Code Execution in Red Discord Bot
CVE-2020-15140

8.2HIGH

Key Information:

Vendor

Cog-creators

Status
Red-discordbot
Vendor
CVE Published:
21 August 2020

What is CVE-2020-15140?

In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.

Affected Version(s)

Red-DiscordBot < 3.3.11

References

https://github.com/Cog-Creators/Red-DiscordBot/security/a...
x_refsource_CONFIRM
https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.