Lucene search

[email protected]CVE-2021-33790

HistoryMay 31, 2021 - 4:15 a.m.

CVE-2021-33790

2021-05-3104:15:08

CWE-502

[email protected]

web.nvd.nist.gov

reborncore

library

remote code execution

deserialization

objectinputstream

nvd

cve-2021-33790

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.031 Low

EPSS

Percentile

91.1%

JSON

The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.

Affected configurations

NVD

Node

minecraftminecraftMatch-

AND

techrebornreborncoreRange≤3.13.8

techrebornreborncoreRange3.19.0–3.19.5

techrebornreborncoreRange4.2.0–4.2.10

techrebornreborncoreRange4.7.0–4.7.3

CPENameOperatorVersion
techreborn:reborncoretechreborn reborncorele3.13.8
techreborn:reborncoretechreborn reborncorelt3.19.5
techreborn:reborncoretechreborn reborncorelt4.2.10
techreborn:reborncoretechreborn reborncorelt4.7.3

CPE	Name	Operator	Version
techreborn:reborncore	techreborn reborncore	le	3.13.8
techreborn:reborncore	techreborn reborncore	lt	3.19.5
techreborn:reborncore	techreborn reborncore	lt	4.2.10
techreborn:reborncore	techreborn reborncore	lt	4.7.3

References

github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrm

vuln.ryotak.me/advisories/45

www.curseforge.com/minecraft/mc-mods/reborncore

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.031 Low

EPSS

Percentile

91.1%

JSON

Related for CVE-2021-33790

prion1 cvelist1 nvd1