Vulnerability · Published Oct 13, 2020 · Assigned by GitHub_M
CVE-2020-15251Privilege Escalation in Channelmgnt plug-in for Sopel
High 7.7
In plain English
A high-severity incorrect authorization in sopel-channelmgnt from MirahezeBots. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2 includes 1.0.3 of channelmgnt, and thus is safe from this vulnerability. See referenced GHSA-23pc-4339-95vg.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | sopel-plugins-channelmgnt | 1.0.3 | GHSA-j257-jfvv-h3x5 |
| PyPI | sopel-plugins-channelmgnt | 1.0.3 | GHSA-j257-jfvv-h3x5 |
| PyPI | sopel-plugins-channelmgnt | 1.0.3 | PYSEC-2020-110 |
| Ubuntu:22.04:LTS | sopel | no fix listed | UBUNTU-CVE-2020-15251 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MirahezeBots | sopel-channelmgnt | < 1.0.3 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
References
- https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5 x_refsource_CONFIRM
- https://github.com/MirahezeBots/sopel-channelmgnt/pull/3 x_refsource_MISC
- https://phab.bots.miraheze.wiki/T117 x_refsource_MISC
- https://pypi.org/project/sopel-plugins.channelmgnt/ x_refsource_MISC
- https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg x_refsource_MISC
- https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary/ x_refsource_MISC