RCE in Cogboard Red Discord Bot
CVE-2020-15147
Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (84.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000
Affected products
- Cogboard Red Discord Bot
- Cog-Creators Red-Discordbot — versions < 3.3.12
Weakness classification (CWE)
References
- github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x (Third Party Advisory)
- github.com/Cog-Creators/Red-DiscordBot/pull/4183 (Patch, Third Party Advisory)
- github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15147?
- CVE-2020-15147 is a high-severity vulnerability in Cogboard Red Discord Bot, classified under Code Injection. CVSS score: 8.5/10. Published 2020-08-21.
- How severe is CVE-2020-15147?
- High severity. CVSS v3 base score is 8.5 out of 10.