CVE-2020-15172 json
Remote Code Execution in Act module
published 2020-09-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-7242
- cvss
- 8.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module with `unload act` can render this exploit inaccessible.
Patch / fix
- fluffycogs_project fluffycogs 2.0.38
Exploit prediction
1.82% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- zephyrkul FluffyCogs
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/zephyrkul/FluffyCogs/commit/6b9f3b862e1f0a5429c62f3090f814e53a242347
patch, third-party-advisory
-
github.com
/zephyrkul/FluffyCogs/security/advisories/GHSA-rm7m-j4xp-rv2p
patch, third-party-advisory
Sources
- CVE List CVE-2020-15172
- NVD CVE-2020-15172
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.