CVE-2024-34712

{"id": "CVE-2024-34712", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-05-14T16:17:26.600", "references": [{"url": "https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe", "source": "security-advisories@github.com"}, {"url": "https://github.com/OceanicJS/Oceanic/security/advisories/GHSA-5h5v-hw44-f6gg", "source": "security-advisories@github.com"}, {"url": "https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/OceanicJS/Oceanic/security/advisories/GHSA-5h5v-hw44-f6gg", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input, ensuring strings are valid for the purpose they are being used for. One may also encode input with `encodeURIComponent` before providing it to the library."}, {"lang": "es", "value": "Oceanic es una librer\u00eda NodeJS para interactuar con Discord. Antes de la versi\u00f3n 1.10.4, la entrada a funciones como `Client.rest.channels.removeBan` no est\u00e1 codificada en URL, lo que generaba entradas especialmente manipuladas como `../../../channels/{id}` normalizarse en la URL `/api/v10/channels/{id}` y eliminar un canal en lugar de eliminar una prohibici\u00f3n. La versi\u00f3n 1.10.4 soluciona este problema. Algunas soluciones est\u00e1n disponibles. Se pueden desinfectar las entradas del usuario, asegur\u00e1ndose de que las cadenas sean v\u00e1lidas para el prop\u00f3sito para el que se utilizan. Tambi\u00e9n se puede codificar la entrada con `encodeURIComponent` antes de proporcionarla a la librer\u00eda."}], "lastModified": "2024-11-21T09:19:14.830", "sourceIdentifier": "security-advisories@github.com"}