XSS in Cogboard Red-Dashboard
CVE-2020-26249
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.013 (69.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 69.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: +0.000
Affected products
- Cogboard Red-Dashboard — versions 0.1.2, 0.1.3, 0.1.4
- Cog-Creators Red-Dashboard — versions < 0.1.7a
Weakness classification (CWE)
References
- github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqm-gjm4 (Patch, Third Party Advisory)
- pypi.org/project/Red-Dashboard (Product, Third Party Advisory)
- github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7d1cc2d40… (Patch, Third Party Advisory)
- github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784ae8e31e… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-26249?
- CVE-2020-26249 is a high-severity vulnerability in Cogboard Red-Dashboard, classified under Cross-site Scripting. CVSS score: 7.7/10. Published 2020-12-09.
- How severe is CVE-2020-26249?
- High severity. CVSS v3 base score is 7.7 out of 10.