PT-2020-14245 · Discord · Red Discord Bot

Zephyrkul · Published 2020-09-15 · Updated 2020-10-08 · CVE-2020-15172

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Discord Bot Act module versions prior to commit 6b9f3b86

Description The issue allows Discord users to send specially crafted messages, potentially leading to destructive actions and unauthorized access to sensitive information. This is due to a Remote Code Execution flaw.

Recommendations For versions prior to commit 6b9f3b86, as a temporary workaround, consider unloading the Act module with unload act until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-15172

GHSA-RM7M-J4XP-RV2P

Affected Products

Red Discord Bot

References · 4

• https://github.com/zephyrkul/FluffyCogs/security/advisories/GHSA-rm7m-j4xp-rv2p · Patch
• https://github.com/zephyrkul/FluffyCogs/commit/6b9f3b862e1f0a5429c62f3090f814e53a242347 · Patch
• https://osv.dev/vulnerability/CVE-2020-15172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15172 · Security Note