CVE-2020-5302 unprivileged user can access priviledged action in MH-WikiBot
Unprivileged users can execute privileged steward commands by impersonating a logged-in nickname due to missing authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-5302?
CVE-2020-5302 is a high-severity authentication bypass vulnerability in examknow MH-WikiBot, published on 7 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1.
Which versions are affected by CVE-2020-5302?
It affects 1 product.
Products include Mh-Wikibot Project Mh-Wikibot.
How do I fix CVE-2020-5302?
No fix has been published for CVE-2020-5302 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-5302 being exploited?
There is no known exploitation of CVE-2020-5302 in the wild and no public exploit code.
Sources
Also known as GHSA-7hf3-wvp8-34r9.