Privilege Escalation in Channelmgnt plug-in for Sopel · CVE-2020-15251 · GitHub Advisory Database · GitHub

Privilege Escalation in Channelmgnt plug-in for Sopel

High severity GitHub Reviewed Published Oct 12, 2020 in FOSSBots/sopel-channelmgnt • Updated Feb 1, 2023

Package

sopel_plugins.channelmgnt (pip)

Affected versions

< 1.0.3

Patched versions

1.0.3

Description

Impact

Malicious users are able to op/voice and take over a channel

Patches

On version 1.0.3

Workarounds

Disable channelmgnt

References

https://phab.bots.miraheze.wiki/T117

For more information

If you have any questions or comments about this advisory:

Email us at staff(at)mirahezebots(dot)org

References

RhinosF1 published to FOSSBots/sopel-channelmgnt

Oct 12, 2020

Reviewed Oct 13, 2020

Published to the GitHub Advisory Database Oct 13, 2020

Published by the National Vulnerability Database

Oct 13, 2020

Last updated Feb 1, 2023

Severity

High

7.7

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N