Privilege Escalation Affecting red-discordbot package, versions [,3.4.1)
Threat Intelligence
EPSS
0.24% (63rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-REDDISCORDBOT-1023166
- published 28 Oct 2020
- disclosed 27 Oct 2020
- credit jack1142
Introduced: 27 Oct 2020
CVE-2020-15278 Open this link in a new tabHow to fix?
Upgrade Red-DiscordBot to version 3.4.1 or higher.
Overview
Red-DiscordBot is an A highly customisable Discord bot
Affected versions of this package are vulnerable to Privilege Escalation in the Mod module. This vulnerability allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this issue, it's possible to perform destructive actions within the guild the user has high privileges in.
References
CVSS Scores
version 3.1