PT-2018-6234 · Discord · Discord.Js

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2017-16207

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: discordi.js versions (affected versions not specified)

Description: The issue concerns a malicious module named discordi.js, which is based on the discord.js library. This module is designed to exfiltrate login tokens to pastebin. It attempts to discover and exfiltrate a user's Discord credentials, sending them to pastebin. The estimated number of potentially affected devices worldwide is not available.

Recommendations: Do not install or use the discordi.js module. Any users that logged into Discord using this library will need to change their credentials.

Correção

RCE

Enumeração de Fraquezas

CWE-506

Identificadores relacionados

CVE-2017-16207

GHSA-FV9M-F7W4-889C

Produtos afetados

Discord.Js

Referências · 6

• https://npmjs.com/advisories/545 · Nota
• https://osv.dev/vulnerability/CVE-2017-16207 · Aviso do Fabricante
• https://nodesecurity.io/advisories/545 · Nota
• https://github.com/advisories/GHSA-fv9m-f7w4-889c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16207 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fv9m-f7w4-889c · Aviso do Fabricante