GitHub Advisoryadvisory · PyPI

GHSA-55j9-849x-26h4 Remote Code Execution in Red Discord Bot

MEDIUM Published 2020-08-21 Modified 2024-10-25 Official page ↗
Aliases
CVE-2020-15140
Ecosystem
PyPI
Packages
Red-DiscordBot
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-74
Reviewed
2020-08-21

Affected packages

• PyPI Red-DiscordBot: < 3.3.11 → fixed in 3.3.11

Description

Impact A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. Patches This critical exploit has been fixed on version 3.3.11. Workarounds Unloading the Trivia module with ``unload trivia`` can render this exploit not accessible. We still highly recommend updating to 3.3.11 to completely patch this issue. References https://github.com/Cog-Creators/Red-DiscordBot/pull/4175 For more information If you have any questions or comments about this advisory: • Open an issue in Cog-Creators/Red-DiscordBot • Over on our Discord server

Related

Alias · CVE (1)

  • CVE-2020-15140 In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References