Homepage
About Snyk

Relative Path Traversal Affecting oceanic.js package, versions <1.10.4

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-OCEANICJS-6846187
  • published 15 May 2024
  • disclosed 14 May 2024
  • credit Vendicated
Report a new vulnerability Found a mistake?

Introduced: 14 May 2024

CVE-2024-34712 Open this link in a new tab
CWE-23 Open this link in a new tab

How to fix?

Upgrade oceanic.js to version 1.10.4 or higher.

Overview

oceanic.js is an A NodeJS library for interfacing with Discord.

Affected versions of this package are vulnerable to Relative Path Traversal due to improper sanitization in the Client.rest.channels.removeBan function. An attacker can manipulate URLs and perform unauthorized actions by injecting specially crafted input.

References

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
6.5 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    High
  • Availability (A)
    None