CVE-2020-15140 describes a critical Remote Code Execution (RCE) vulnerability in Red Discord Bot versions prior to 3.3.11, specifically within its Trivia module. Malicious Discord users could inject code into the leaderboard command via specially crafted usernames, affecting the cogboard red_discord_bot product. With a CVSS score of 9.6 (CRITICAL), this vulnerability is easily exploitable over the network with low complexity, requiring only low privileges, and could lead to high impact in terms of confidentiality and integrity. The potential for destructive actions and access to sensitive information is significant. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.3.11CPE matchmatch criteria | cpe:2.3:a:cogboard:red_discord_bot:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.