CVE-2020-15140
CVE-2020-15140 · Remote Code Execution in Red Discord Bot
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
CVSS 8.2 · High · EPSS 1.2% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
red-discordbot
- Versions
- < 3.3.11: Affected
No fix published
red-discordbot PyPI
- Versions
- 3.0.0
- 3.0.0b16
- 3.0.0b17
- 3.0.0b18
- 3.0.0b19
- 3.0.0b20
- 3.0.0b21
- 3.0.0rc1
- 3.0.0rc1.post1
- 3.0.0rc2
- 3.0.0rc3
- 3.0.0rc3.post1
- 3.0.1
- 3.0.2
- 3.1.0
- 3.1.1
- 3.1.2
- 3.1.3
- 3.1.4
- 3.1.5
- 3.1.6
- 3.1.7
- 3.1.8
- 3.1.9
- 3.2.0
- 3.2.1
- 3.2.2
- 3.2.3
- 3.3.0
- 3.3.1
- 3.3.10
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- 3.3.6
- 3.3.7
- 3.3.8
- 3.3.9
- Affected ranges
- ECOSYSTEM: < 3.3.11
Update to 3.3.11
red-discordbot PyPI
- Versions
- 3.0.0
- 3.0.0b16
- 3.0.0b17
- 3.0.0b18
- 3.0.0b19
- 3.0.0b20
- 3.0.0b21
- 3.0.0rc1
- 3.0.0rc1.post1
- 3.0.0rc2
- 3.0.0rc3
- 3.0.0rc3.post1
- 3.0.1
- 3.0.2
- 3.1.0
- 3.1.1
- 3.1.2
- 3.1.3
- 3.1.4
- 3.1.5
- 3.1.6
- 3.1.7
- 3.1.8
- 3.1.9
- 3.2.0
- 3.2.1
- 3.2.2
- 3.2.3
- 3.3.0
- 3.3.1
- 3.3.10
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- 3.3.6
- 3.3.7
- 3.3.8
- 3.3.9
- Affected ranges
- GIT: < 9ab536235bafc2b42c3c17d7ce26f1cc64482a81
- ECOSYSTEM: < 3.3.11
Update to 3.3.11