Lucene search

[email protected]NVD:CVE-2024-43404

HistoryAug 20, 2024 - 3:15 p.m.

CVE-2024-43404

2024-08-2015:15:23

CWE-95

CWE-94

[email protected]

web.nvd.nist.gov

megabot

discord

remote code execution

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.6%

JSON

MEGABOT is a fully customized Discord bot for learning and fun. The /math command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python eval(). The vulnerability allows an attacker to inject Python code into the expression parameter when using /math in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

Affected configurations

Nvd

Node

megacordmegabotRange<1.5.0

VendorProductVersionCPE
megacordmegabot*cpe:2.3:a:megacord:megabot:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
megacord	megabot	*	cpe:2.3:a:megacord:megabot::::::::

References

github.com/NicPWNs/MEGABOT/commit/71e79e5581ea36313700385b112d863053fb7ed6

github.com/NicPWNs/MEGABOT/issues/137

github.com/NicPWNs/MEGABOT/pull/138

github.com/NicPWNs/MEGABOT/releases/tag/v1.5.0

github.com/NicPWNs/MEGABOT/security/advisories/GHSA-vhxp-4hwq-w3p2

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.6%

JSON

Related for NVD:CVE-2024-43404

osv1 cvelist1 cve1 vulnrichment1