Privilege Escalation in Channelmgnt plug-in for Sopel

中危 6.5CVE-2020-15251 · GHSA-23pc-4339-95vg · GHSA-j257-jfvv-h3x5 · Published 13/10/2020 · updated 17/06/2026

要点

CVE-2020-15251 是影响 sopel-plugins-channelmgnt, channelmgnt (mirahezebots) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.5%，高于 73.6% 的漏洞。
修复：升级到 1.0.3 或更高版本。

Package	Affected versions	Patched versions
sopel-plugins-channelmgnt PyPI	`< 1.0.3`	`1.0.3`
channelmgnt mirahezebots	`< 1.0.3`	`1.0.3`

Description

Impact

Malicious users are able to op/voice and take over a channel

Patches

On version 1.0.3

Workarounds

Disable channelmgnt

References

https://phab.bots.miraheze.wiki/T117

For more information

If you have any questions or comments about this advisory:

Email us at staff(at)mirahezebots(dot)org

NVD description

In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2 includes 1.0.3 of channelmgnt, and thus is safe from this vulnerability. See referenced GHSA-23pc-4339-95vg.

References

MirahezeBots/MirahezeBots security advisory · WEB
MirahezeBots/sopel-channelmgnt security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-15251 · ADVISORY
MirahezeBots/sopel-channelmgnt#3 · WEB
MirahezeBots/MirahezeBots · PACKAGE
pypa/advisory-database · WEB
phab.bots.miraheze.wiki/T117 · WEB
phab.bots.miraheze.wiki/phame/live/1/post/1/summary · WEB
pypi.org/project/sopel-plugins.channelmgnt · WEB
phab.bots.miraheze.wiki/phame/live/1/post/1/summary · Broken Link
pypi.org/project/sopel-plugins.channelmgnt · Product

sopel-plugins-channelmgnt 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free