CVE-2014-9773

modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.

CVSS v3.0 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3.0 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-updates/2016-05/msg00061.html
https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b	Vendor Advisory
https://github.com/atheme/atheme/issues/397
http://www.openwall.com/lists/oss-security/2016/05/02/2
http://www.openwall.com/lists/oss-security/2016/05/03/1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:opensuse:opensuse:13.2:::::::*
	cpe:2.3:o:opensuse:leap:42.1:::::::*

Configuration 2 (hide)

cpe:2.3:a:atheme:atheme:*:*:*:*:*:*:*:*

Information

Published : 2016-06-13 19:59

Updated : 2018-10-30 16:27

NVD link : CVE-2014-9773

Mitre link : CVE-2014-9773

JSON object : View

Products Affected

opensuse

leap
opensuse

atheme

atheme

CWE

CWE-284

Improper Access Control

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00061.html", "name": "openSUSE-SU-2016:1312", "tags": [], "refsource": "SUSE"}, {"url": "https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b", "name": "https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/atheme/atheme/issues/397", "name": "https://github.com/atheme/atheme/issues/397", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2016/05/02/2", "name": "[oss-security] 20160502 CVE request: atheme: security fixes", "tags": [], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/05/03/1", "name": "[oss-security] 20160503 Re: CVE request: atheme: security fixes", "tags": [], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-284"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-9773", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2016-06-13T19:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:atheme:atheme:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.2.6"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:27Z"}