GitHub Advisoryadvisory · PyPI
GHSA-j257-jfvv-h3x5 Privilege Escalation in Channelmgnt plug-in for Sopel
MEDIUM
Official page ↗
- Aliases
- CVE-2020-15251
- Ecosystem
- PyPI
- Packages
- sopel_plugins.channelmgnt, sopel-plugins-channelmgnt
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- Weaknesses
- CWE-862, CWE-863
- Reviewed
- 2020-10-13
Affected packages
• PyPI sopel_plugins.channelmgnt: < 1.0.3 → fixed in 1.0.3
• PyPI sopel-plugins-channelmgnt: < 1.0.3 → fixed in 1.0.3
Description
Impact
Malicious users are able to op/voice and take over a channel
Patches
On version 1.0.3
Workarounds
Disable channelmgnt
References
https://phab.bots.miraheze.wiki/T117
For more information
If you have any questions or comments about this advisory:
• Email us at staff(at)mirahezebots(dot)org
Related
Alias · CVE (1)
- CVE-2020-15251 In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. vulnerability
References
- https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg web
- https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5 web
- https://nvd.nist.gov/vuln/detail/CVE-2020-15251 advisory
- https://github.com/MirahezeBots/sopel-channelmgnt/pull/3 web
- https://github.com/MirahezeBots/MirahezeBots package
- https://github.com/pypa/advisory-database/tree/main/vulns/sopel-plugins-channelmgnt/PYSEC-2020-110.yaml web
- https://phab.bots.miraheze.wiki/T117 web
- https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary web
- https://pypi.org/project/sopel-plugins.channelmgnt web