CVE-2021-29466mediumCWE-24

CVE-2021-29466: medium-severity vulnerability in DEMON1A Discord-Recon

Path Traversal at Discord-Recon .recon Command Path

Published · Updated

Follow this CVE+ Monitor Discord-Recon

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.6%
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file `app.py` and add `.replace('..', '')` into the `Path` variable inside of the `recon` function. The vulnerability is patched in version 0.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
DEMON1A · Discord-Recon
Related CVEs — DEMON1A Discord-Recon

In the same product, most dangerous first.

CVE-2021-21433CRITICALRemote code execution on discord-recon .dirsearch and .arjun commands due to improper input validationEPSS 3.3%CVE-2021-29461HIGHLFI and possible code execution on discord-recon using tools argumentsEPSS 2.6%CVE-2021-29465HIGHRemote file overwrite on discord-recon can result in DoS and Remote Code ExecutionEPSS 2.0%CVE-2024-21663CRITICALRemote code execution on ReconServer due to improper input sanitization on the prips commandEPSS 1.5%