by Kastro
Paper/Archive/CVE-2022-24300

CVE-2022-24300

mitre — Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack m…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.9.769 × 2015.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugs.debian.org/1004223refgithub.com/minetest/minetest/commit/b5956bde259faa240a81060ff4e598e25ad52daerefgithub.com/minetest/minetest/security/advisories/GHSA-hwj2-xf72-r4cfadvisorydebian.org/security/2022/dsa-5075