Vulnerability · Published Dec 8, 2020 · Assigned by GitHub_M
CVE-2020-26249Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability
High 7.7
In plain English
A high-severity cross-site scripting in Red-Dashboard from Cog-Creators. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | red-dashboard | 0.1.7a | GHSA-hm45-mgqm-gjm4 |
| PyPI | red-dashboard | 0.1.7a | PYSEC-2020-98 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cog-Creators | Red-Dashboard | < 0.1.7a |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqm-gjm4 x_refsource_CONFIRM
- https://pypi.org/project/Red-Dashboard x_refsource_MISC
- https://github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7d1cc2d40c7ab91 x_refsource_MISC
- https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784ae8e31e955ab1 x_refsource_MISC