CVE-2021-29466: Path Traversal at Discord-Recon .recon Command Path
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file app.py and add .replace('..', '') into the Path variable inside of the recon function. The vulnerability is patched in version 0.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29466?
CVE-2021-29466 has a medium severity rating due to its potential to expose sensitive local files.
How do I fix CVE-2021-29466?
To fix CVE-2021-29466, users should upgrade to Discord-Recon version 0.0.4 or later.
What type of vulnerability is CVE-2021-29466?
CVE-2021-29466 is a file disclosure vulnerability that allows remote attackers to read local files.
Which versions of Discord-Recon are affected by CVE-2021-29466?
CVE-2021-29466 affects all versions of Discord-Recon prior to 0.0.4.
Can I mitigate CVE-2021-29466 without updating?
As a temporary workaround, bot maintainers can manually modify the 'app.py' file to implement specific changes.