XSS in Cogboard Red-Dashboard
CVE-2020-26249
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.013 (67.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Cogboard Red-dashboard — versions 0.1.2, 0.1.3, 0.1.4
- Cog-creators Red-dashboard — versions < 0.1.7a
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Product, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-26249?
- CVE-2020-26249 is a high-severity vulnerability in Cogboard Red-Dashboard, classified under Cross-site Scripting. CVSS score: 7.7/10. Published 2020-12-09.
- How severe is CVE-2020-26249?
- High severity. CVSS v3 base score is 7.7 out of 10.