CVE-2014-9773 Missing authorization in n/a
Remote attackers can modify Anope FLAGS behavior by registering and dropping specific keyword nicks in Atheme IRC services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9773?
CVE-2014-9773 is a high-severity missing authorization vulnerability in Opensuse Leap, published on 13 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.
Weakness: CWE-284
Which versions are affected by CVE-2014-9773?
It affects 3 products.
Products include Atheme Atheme, Opensuse Leap, Opensuse Opensuse.
How do I fix CVE-2014-9773?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-9773 being exploited?
There is no known exploitation of CVE-2014-9773 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as DEBIAN-CVE-2014-9773, GHSA-v7vr-x2pf-8x73.