Lucene search

GitHub_MCVELIST:CVE-2021-39177

HistoryAug 30, 2021 - 11:00 p.m.

CVE-2021-39177 User impersonation due to incorrect handling of the login JWT

2021-08-3023:00:12

CWE-287

GitHub_M

www.cve.org

cve-2021-39177

user impersonation

geyser 1.4.2-snapshot

minecraft

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

64.7%

JSON

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.

CNA Affected

[
  {
    "product": "Geyser",
    "vendor": "GeyserMC",
    "versions": [
      {
        "status": "affected",
        "version": "<= 1.4.1-SNAPSHOT"
      }
    ]
  }
]

References

github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6

github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858

updates.playhive.com/weekend-maintenance-disclosure-2kJMaY

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

64.7%

JSON

Related for CVELIST:CVE-2021-39177