GitHub Advisoryadvisory · PyPI

GHSA-hm45-mgqm-gjm4 Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability

MEDIUM Published 2020-12-08 Modified 2024-10-25 Official page ↗
Aliases
CVE-2020-26249
Ecosystem
PyPI
Packages
red-dashboard
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-12-08

Affected packages

• PyPI red-dashboard: < 0.1.7a → fixed in 0.1.7a

Description

Impact A RCE exploit has been discovered in the Red Discord Bot - Dashboard Webserver: this exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. Patches This high severity exploit has been fixed on version `0.1.7a`. Workarounds There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue References • 99d88b8 • a6b9785 For more information If you have any questions or comments about this advisory: • Open an issue in Cog-Creators/Red-Dashboard • Over on the official Red Server or at the Third Party Server Toxic Layer

Related

Alias · CVE (1)

  • CVE-2020-26249 Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References