CVE-2023-54396

Summary

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

Affected Software

Weaknesses

• CWE-129: Improper Validation of Array Index

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g
• https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb
• https://www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbt

• ←Previous
• Next→