CVE-2020-26249 — HIGH (7.7)

Vulnerability Description

Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.

CVSS Score

7.7

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Cogboard	Red-Dashboard	0.1.2

Related Weaknesses (CWE)

CWE-79

References

https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784PatchThird Party Advisory
https://github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7dPatchThird Party Advisory
https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqmPatchThird Party Advisory
https://pypi.org/project/Red-DashboardProductThird Party Advisory
https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784PatchThird Party Advisory
https://github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7dPatchThird Party Advisory
https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqmPatchThird Party Advisory
https://pypi.org/project/Red-DashboardProductThird Party Advisory

FAQ

What is CVE-2020-26249?

CVE-2020-26249 is a vulnerability with a CVSS score of 7.7 (HIGH). Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord u...

How severe is CVE-2020-26249?

CVE-2020-26249 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-26249?

Check the references section above for vendor advisories and patch information. Affected products include: Cogboard Red-Dashboard.