RCE in Cogboard Red Discord Bot
CVE-2020-15147
Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.026 (83.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Cogboard Red_discord_bot
- Cog-creators Red-discordbot — versions < 3.3.12
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-15147?
- CVE-2020-15147 is a high-severity vulnerability in Cogboard Red Discord Bot, classified under Code Injection. CVSS score: 8.5/10. Published 2020-08-21.
- How severe is CVE-2020-15147?
- High severity. CVSS v3 base score is 8.5 out of 10.