PT-2020-14226 · Discord · Red Discord Bot

Jackenmen + 1 · Published 2020-08-21 · Updated 2021-11-18 · CVE-2020-15147

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Discord Bot versions prior to 3.3.12 and 3.4

Description The issue allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message, potentially leading to destructive actions and/or access to sensitive information.

Recommendations For versions prior to 3.3.12 and 3.4, update to version 3.3.12 or 3.4 to completely patch the issue. As a temporary workaround, consider unloading the Streams module with unload streams to render the exploit not accessible.

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

CVE-2020-15147

GHSA-7257-96VG-QF6X

PYSEC-2020-266

Affected Products

Red Discord Bot

References · 9

• https://github.com/Cog-Creators/Red-DiscordBot/pull/4183 · Patch
• https://github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18431b1df38a9be92bfc · Patch
• https://osv.dev/vulnerability/PYSEC-2020-266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15147 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15147 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7257-96vg-qf6x · Vendor Advisory
• https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x · Note
• https://github.com/Cog-Creators/Red-DiscordBot · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/red-discordbot/PYSEC-2020-266.yaml · Note