PT-2021-18233 · Unknown · Discord-Recon

0Xwise64 · Published 2021-04-22 · Updated 2022-10-18 · CVE-2021-29465

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Discord-Recon versions 0.0.3 and prior

Description: The issue allows a remote attacker to overwrite any file on the system with command results, potentially leading to remote code execution if important system files are overwritten.

Recommendations: For versions 0.0.3 and prior, as a temporary workaround, bot maintainers can edit their setting.py file and add < and > into the RCE variable to mitigate the issue without an update. For versions 0.0.3 and prior, update to version 0.0.4 to resolve the issue.

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

CVE-2021-29465

GHSA-6PP2-RPJ3-JCJX

Affected Products

Discord-Recon

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-29465 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29465 · Vendor Advisory
• https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-6pp2-rpj3-jcjx · Note