RCE in Demon1a Discord-Recon
CVE-2021-29465
Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files on the system. As a workaround, bot maintainers can edit their `setting.py` file then add `<` and `>` into the `RCE` variable inside of it to fix the issue without an update. The vulnerability is patched in version 0.0.4.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.020 (79.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 79.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: 0.000
Affected products
- Demon1a Discord-Recon — versions <= 0.0.3
- Discord Discord-Recon
Weakness classification (CWE)
References
- github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-6pp2-rpj3-jcjx (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2021-29465?
- CVE-2021-29465 is a high-severity vulnerability in Demon1a Discord-Recon, classified under Code Injection. CVSS score: 8.3/10. Published 2021-04-22.
- How severe is CVE-2021-29465?
- High severity. CVSS v3 base score is 8.3 out of 10.