Vulnerability Description
MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mh-Wikibot Project | Mh-Wikibot | < 2020-04-06 |
Related Weaknesses (CWE)
References
- https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1
- https://github.com/examknow/MH-WikiBot/security/advisories/GHSA-7hf3-wvp8-34r9Third Party Advisory
- https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1
- https://github.com/examknow/MH-WikiBot/security/advisories/GHSA-7hf3-wvp8-34r9Third Party Advisory
FAQ
What is CVE-2020-5302?
CVE-2020-5302 is a vulnerability with a CVSS score of 8.2 (HIGH). MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a ...
How severe is CVE-2020-5302?
CVE-2020-5302 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-5302?
Check the references section above for vendor advisories and patch information. Affected products include: Mh-Wikibot Project Mh-Wikibot.