Lucene search

MitreCVE-2023-29478

HistoryApr 07, 2023 - 4:15 a.m.

CVE-2023-29478

2023-04-0704:15:41

CWE-22

mitre

web.nvd.nist.gov

bibliocraft

cve-2023-29478

path traversal

filesystem access

code execution

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.006

Percentile

78.3%

JSON

BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution.

Affected configurations

Nvd

Node

bibliocraftmodbibliocraftRange<2.4.6minecraft

VendorProductVersionCPE
bibliocraftmodbibliocraft*cpe:2.3:a:bibliocraftmod:bibliocraft:*:*:*:*:*:minecraft:*:*

Vendor	Product	Version	CPE
bibliocraftmod	bibliocraft	*	cpe:2.3:a:bibliocraftmod:bibliocraft::::::minecraft::*

References

github.com/Exopteron/BiblioRCE

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.006

Percentile

78.3%

JSON

Related for CVE-2023-29478