Improper input validation in Mirahezebots Channelmgnt
CVE-2021-21431
sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fixed in version 2.0.1. As a workaround, do not use this plugin on networks where TARGMAX > 1.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.011 (61.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H.
Affected products
- Mirahezebots Channelmgnt
- Mirahezebots Sopel-channelmgnt — versions < 2.0.1
Weakness classification (CWE)
References
- security-advisories@github.com (Product, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-21431?
- CVE-2021-21431 is a high-severity vulnerability in Mirahezebots Channelmgnt, classified under Improper Input Validation. CVSS score: 7.6/10. Published 2021-04-09.
- How severe is CVE-2021-21431?
- High severity. CVSS v3 base score is 7.6 out of 10.