CVE-2020-5302 - unprivileged user can access priviledged action in MH-WikiBot

Back Back to CVE browser

HIGH

unprivileged user can access priviledged action in MH-WikiBot

Published Apr 7, 2020

8.2

HIGH

CVSS 3.1

EPSS 0.90%

Description

MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1.

Affected products

Vendor Examknow Product MH-WikiBot Default
n/a
- Version
  < commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Examknow

MH-WikiBot

n/a

Version	Status	Constraints
< commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-269

Improper Privilege Management

CWE-284

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26489
Advisory
https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1
x_refsource_MISC
https://github.com/examknow/MH-WikiBot/security/advisories/GHSA-7hf3-wvp8-34r9
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26489		Advisory
https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1		x_refsource_MISC
https://github.com/examknow/MH-WikiBot/security/advisories/GHSA-7hf3-wvp8-34r9		x_refsource_CONFIRMThird Party Advisory