What is CVE-2021-29465?

CVE-2021-29465 is a high-severity vulnerability in Demon1a Discord-Recon, classified under Code Injection. CVSS score: 8.3/10. Published 2021-04-22.

How severe is CVE-2021-29465?

High severity. CVSS v3 base score is 8.3 out of 10.

RCE in Demon1a Discord-Recon

CVE-2021-29465

Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files on the system. As a workaround, bot maintainers can edit their `setting.py` file then add `<` and `>` into the `RCE` variable inside of it to fix the issue without an update. The vulnerability is patched in version 0.0.4.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.020 (78.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H.

Affected products

Demon1a Discord-recon — versions <= 0.0.3
Discord Discord-recon

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation)

Frequently asked questions

What is CVE-2021-29465?: CVE-2021-29465 is a high-severity vulnerability in Demon1a Discord-Recon, classified under Code Injection. CVSS score: 8.3/10. Published 2021-04-22.
How severe is CVE-2021-29465?: High severity. CVSS v3 base score is 8.3 out of 10.