CVE-2021-29466mediumCWE-24

CVE-2021-29466: falha de média gravidade em DEMON1A Discord-Recon

Path Traversal at Discord-Recon .recon Command Path

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Discord-Recon

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.6%
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file `app.py` and add `.replace('..', '')` into the `Path` variable inside of the `recon` function. The vulnerability is patched in version 0.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
DEMON1A · Discord-Recon
CVEs relacionadas — DEMON1A Discord-Recon

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21433CRITICALRemote code execution on discord-recon .dirsearch and .arjun commands due to improper input validationEPSS 3.3%CVE-2021-29461HIGHLFI and possible code execution on discord-recon using tools argumentsEPSS 2.5%CVE-2021-29465HIGHRemote file overwrite on discord-recon can result in DoS and Remote Code ExecutionEPSS 2.0%CVE-2024-21663CRITICALRemote code execution on ReconServer due to improper input sanitization on the prips commandEPSS 1.5%