CVE-2020-5302CWE-284

unprivileged user can access priviledged action in MH-WikiBot

High · published April 7, 2020

CVSS v3.1
8.2
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00895 · 59.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2020-04-07T15:40Z
EPSS history
Timeline
  • 07 APR 15:40Z
    unprivileged user can access priviledged action in MH-WikiBot
    cvelistv5