CVE-2020-15140 High · 8.2 EPSS 1.2%

Remote Code Execution in Red Discord Bot

Cog-Creators · Red-DiscordBot

Official description · CVE.org

In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.

Breakdown

19.1 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Get in through VPN or remote-access servicesT1133 · External Remote ServicesSource data20 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules

Disclosed on 21 Aug 2020. No public exploit code or confirmed exploitation is recorded.

4 fixes in Red-DiscordBot over 4 years. The latest fix listed for Red-DiscordBot is 3.5.10.

Fixes in Red-DiscordBotPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

3.3.11CVE-2020-1514021 Aug 2020
3.3.12CVE-2020-1514721 Aug 2020
3.4.1CVE-2020-1527828 Oct 2020
3.5.10CVE-2024-3990511 Jul 2024Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

External Remote Services T1133 also Persistence

MITRE CTID mapping of the CVE · how it is exploited

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 115 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-15140 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

External Remote ServicesT113320 general rules

External Remote SMB Logon from Public IPhightest
OpenCanary - SSH Login Attempthightest
OpenCanary - SSH New Connection Attempthightest
OpenCanary - Telnet Login Attempthightest
Running Chrome VPN Extensions via the Registry 2 VPN Extensionhightest
Unusual Child Process of dns.exehightest
Unusual File Deletion by Dns.exehightest
Unusual File Modification by dns.exehightest

All 20 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Red-DiscordBot.

PyPIRed-DiscordBotGHSA-55j9-849x-26h4 PYSEC-2020-265

Upgrade to 3.3.12 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2020-15147).

pippip install "Red-DiscordBot>=3.3.12"

First fixed in 3.3.11 for CVE-2020-15140.

Affected versions

If you run	Upgrade to
All versions before 3.3.11	3.3.12first fix for this CVE: 3.3.11

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4

x_refsource_MISC 1

github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0163

No public exploit code found.

, 30 Oct 2026

1.2%Top 33%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 67%).

3.1

8.2High · 8.2

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.6701 13.4/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 8.2 5.7/7

End-of-life productsupported or unknown 0.0

Total19.1

Record

Published: 21 Aug 2020
Modified: 4 Aug 2024
: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.