PT-2020-14220 · Discord · Red Discord Bot

Douglascdev · Published 2020-08-21 · Updated 2021-11-18 · CVE-2020-15140

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Red Discord Bot versions prior to 3.3.11

Description A remote code execution exploit has been discovered in the Trivia module, allowing Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. This exploit can be used to perform destructive actions and/or access sensitive information.

Recommendations For versions prior to 3.3.11, update to version 3.3.11 to completely patch this issue. As a temporary workaround, consider unloading the Trivia module with unload trivia to render this exploit not accessible.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-15140

GHSA-55J9-849X-26H4

PYSEC-2020-265

Affected Products

Red Discord Bot

References · 8

• https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15140 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15140 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55j9-849x-26h4 · Vendor Advisory
• https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4 · Note
• https://github.com/Cog-Creators/Red-DiscordBot · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/red-discordbot/PYSEC-2020-265.yaml · Note