Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWoyNTctamZ2di1oM3g1

Privilege Escalation in Channelmgnt plug-in for Sopel

Impact

Malicious users are able to op/voice and take over a channel

Patches

On version 1.0.3

Workarounds

Disable channelmgnt

References

https://phab.bots.miraheze.wiki/T117

For more information

If you have any questions or comments about this advisory:

• Email us at staff(at)mirahezebots(dot)org

Permalink: https://github.com/advisories/GHSA-j257-jfvv-h3x5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWoyNTctamZ2di1oM3g1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 4 years ago
Updated: 16 days ago

CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Identifiers: GHSA-j257-jfvv-h3x5, CVE-2020-15251
References:

• https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5
• https://github.com/MirahezeBots/sopel-channelmgnt/pull/3
• https://phab.bots.miraheze.wiki/T117
• https://nvd.nist.gov/vuln/detail/CVE-2020-15251
• https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg
• https://github.com/pypa/advisory-database/tree/main/vulns/sopel-plugins-channelmgnt/PYSEC-2020-110.yaml
• https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary
• https://pypi.org/project/sopel-plugins.channelmgnt
• https://github.com/advisories/GHSA-j257-jfvv-h3x5

Repository: https://github.com/MirahezeBots/sopel-channelmgnt
Blast Radius: 0.0

Affected Packages