Vulnerability in Cogboard Red Discord Bot
CVE-2020-15140
In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.012 (65.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 65.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Cogboard Red Discord Bot
- Cog-Creators Red-Discordbot — versions < 3.3.11
Weakness classification (CWE)
References
- github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4 (Third Party Advisory)
- github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15140?
- CVE-2020-15140 is a high-severity vulnerability in Cogboard Red Discord Bot, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.2/10. Published 2020-08-21.
- How severe is CVE-2020-15140?
- High severity. CVSS v3 base score is 8.2 out of 10.