by Kastro
Paper/Archive/CVE-2021-33806

CVE-2021-33806

mitre — The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputSt…

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.3.873 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbdew.netrefcurseforge.com/minecraft/mc-mods/bdlib/files/3331330refvuln.ryotak.me/advisories/46refgithub.com/bdew-minecraft/bdlib/commit/447210530ceec72fb3374efecb0930ed359d2297