CVE-2020-5302
High
Description
MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1.
SeverityHigh
CVSS8.2
Exploit probability—
ProductMh-wikibot
PublishedApr 7, 2020
First seenApr 7, 2020
Weakness typeCWE-284Improper access control
How to fix
Update
- mh-wikibot_project mh-wikibot2020-04-06 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mh-wikibot_project mh-wikibot | v < 2020-04-06 | 2020-04-06 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.