NVD Vulnerability Detail

CVE-2020-15251

Summary	In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2 includes 1.0.3 of channelmgnt, and thus is safe from this vulnerability. See referenced GHSA-23pc-4339-95vg.
Publication Date	Oct. 14, 2020, 3:15 a.m.
Registration Date	Jan. 26, 2021, 11:53 a.m.
Last Update	Nov. 21, 2024, 2:05 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:mirahezebots:channelmgnt::::::sopel::*					1.0.3

Related information, measures and tools

No	URL	タグ
1	https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg	Third Party Advisory
2	https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg	Third Party Advisory
3	https://github.com/MirahezeBots/sopel-channelmgnt/pull/3	Patch Third Party Advisory
4	https://github.com/MirahezeBots/sopel-channelmgnt/pull/3	Patch Third Party Advisory
5	https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5	Third Party Advisory
6	https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5	Third Party Advisory
7	https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary/	Broken Link Vendor Advisory
8	https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary/	Broken Link Vendor Advisory
9	https://phab.bots.miraheze.wiki/T117	Broken Link
10	https://phab.bots.miraheze.wiki/T117	Broken Link
11	https://pypi.org/project/sopel-plugins.channelmgnt/	Product Third Party Advisory
12	https://pypi.org/project/sopel-plugins.channelmgnt/	Product Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-862	認証の欠如	https://cwe.mitre.org/data/definitions/862.html

JVN Vulnerability Information

Sopel 用 Channelmgnt プラグインにおける不正な認証に関する脆弱性

Title	Sopel 用 Channelmgnt プラグインにおける不正な認証に関する脆弱性
Summary	Sopel 用 Channelmgnt プラグインには、不正な認証に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 12, 2020, midnight
Registration Date	May 21, 2021, 4:52 p.m.
Last Update	May 21, 2021, 4:52 p.m.

Affected System

miraheze

Channelmgnt 1.0.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-15251	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15251
National Vulnerability Database (NVD)
2	CVE-2020-15251	https://nvd.nist.gov/vuln/detail/CVE-2020-15251

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-863	https://cwe.mitre.org/data/definitions/863.html

ベンダー情報

No	Name	URL
GitHub
1	Privilege Escalation issue in makemodechange self action logic	https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg
2	Privilege Escalation issue in makemodechange self action logic	https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5
3	[SECURITY] Actually fix #3	https://github.com/MirahezeBots/sopel-channelmgnt/pull/3
mirahezebots
4	T117 ([CVE-2020-15251] makemodechange failed to check access on restricted changes for self actions allowing ACL bypass {Version 9.0.0 - 9.0.2})	https://phab.mirahezebots.org/T117

Change Log

No	Changed Details	Date of change
1	[2021年05月21日] 掲載	May 21, 2021, 4:52 p.m.