CVE-2022-24976

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52Patch, Third Party Advisory
https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/30/4Exploit, Mailing List, Third Party Advisory
https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52Patch, Third Party Advisory
https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/30/4Exploit, Mailing List, Third Party Advisory

Timeline

Published: Feb 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-249779.8ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to u CVE-2022-249788.8Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password CVE-2022-249795.3An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer componen CVE-2022-24987.5An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15 CVE-2022-249807.5An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A m CVE-2022-249816.1A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to injec CVE-2022-249826.5Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other CVE-2022-249837.5Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST resp CVE-2022-249849.8Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload CVE-2022-249858.8Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administr CVE-2022-249867.8KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watchi CVE-2022-249889.8In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.