CVE-2020-15140
HIGHRed Discord Bot < 3.3.11 - Remote Code Execution via Trivia Leaderboard Command
Title source: llmDescription
In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4
Patch, Third Party Advisory x_refsource_misc
https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81
Scores
CVSS v3
8.2
EPSS
0.0092
EPSS Percentile
55.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Details
CWE
CWE-74
Status
published
Products (2)
cogboard/red_discord_bot
< 3.3.11
pypi/Red-DiscordBot
0 - 3.3.11PyPI
Published
Aug 21, 2020
Tracked Since
Feb 18, 2026