CVE-2014-9773 — Improper Access Control in Atheme-services

CWE-284 — Improper Access Control4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 39.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Debian Atheme-servicesAthemeOpensuse Leap+1 more
Timeline
PublishedJun 13
Latest updateMay 14

Description

modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/atheme-services< atheme-services 7.0.7-2 (bookworm)
▶NVDatheme/atheme7.2.6
▶NVDopensuse/leap42.1

🔴Vulnerability Details

2
GHSA
GHSA-v7vr-x2pf-8x73: modules/chanserv/flags↗2022-05-14
▶
OSV
CVE-2014-9773: modules/chanserv/flags↗2016-06-13
▶

📋Vendor Advisories

1
Debian
CVE-2014-9773: atheme-services - modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modif...↗2014
▶
CVE-2014-9773 — Improper Access Control | cvebase