CVE-2022-24976

    Dashboard / Vulnerabilities / CVE-2022-24976

    CVE-2022-24976

    Published: 13 Feb 2022Last Modified: 12 Aug 2026

    Summary:

    Details: Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.

    References: https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12, https://www.openwall.com/lists/oss-security/2022/01/30/4, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24976.json, https://nvd.nist.gov/vuln/detail/CVE-2022-24976, https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5644554cf3b2de7ebb6ab24a01eef4edc4b2a7eb
    Fixed -937b61ee1a3b6117dd447a4922441872ee2d9b9d

    Affected versions

    v7.2.11
    v7.2.10-r2
    v7.2.9
    v7.2.8
    v7.2.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24976 | CVE-DB