In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
References
Link | Resource |
---|---|
https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81 | Patch Third Party Advisory |
https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2020-08-21T16:40:15
Updated: 2020-08-21T16:40:15
Reserved: 2020-06-25T00:00:00
Link: CVE-2020-15140
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-08-21T17:15:13.287
Modified: 2021-11-18T18:36:15.567
Link: CVE-2020-15140
JSON object: View
Redhat Information
No data.
CWE