CVE-2021-21431

Description

sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fixed in version 2.0.1. As a workaround, do not use this plugin on networks where TARGMAX > 1.

Risk Information

Base Score

8.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

EPSS Score

Exploitation Probability

0.271

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-21431 are fixed in Python-sopel-plugins-channelmgnt 2.0.1	Windows
Vulnerabilities CVE-2021-21431 are fixed in Python-sopel-plugins-channelmgnt for linux 2.0.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234