CVE-2021-21431High· 7.6▾ TwilightImproper Input Validation in sopel-plugins.channelmgnt
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
1.1% → 1.1%
On some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that.
Freenode is not affected.
Upgrade to 2.0.1 or higher
Do not use this plugin on networks where TARGMAX > 1.
If you have any questions or comments about this advisory:
sopel-plugins-channelmgnt < 2.0.1Upgrade to a patched release:
sopel-plugins-channelmgnt 2.0.1