PT-2021-18234 · Unknown · Discord-Recon

Ry0Tak · Published 2021-04-22 · Updated 2021-04-27 · CVE-2021-29466

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Discord-Recon versions 0.0.3 and prior

Description: Discord-Recon is a bot for the Discord chat service. A remote attacker can read local files from the server, disclosing important information.

Recommendations: For versions 0.0.3 and prior, as a temporary workaround, a bot maintainer can locate the file app.py and add .replace('..','') into the Path variable inside of the recon function. Update to version 0.0.4 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-24

CWE-22

Related Identifiers

CVE-2021-29466

GHSA-P2PW-8XWF-879G

Affected Products

Discord-Recon

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-29466 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29466 · Vendor Advisory
• https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-p2pw-8xwf-879g · Note
• https://t.me/cvenotify/13831 · Telegram Post