CVE-2023-37262

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37262
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm Not Applicable
https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126 Product
https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf Patch
https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2 Vendor Advisory
https://github.com/dan200/ComputerCraft/issues/170 Issue Tracking
https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm Not Applicable
https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126 Product
https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf Patch
https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2 Vendor Advisory
https://github.com/dan200/ComputerCraft/issues/170 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*
cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*
cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*
cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*
cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*
History

21 Nov 2024, 08:11

Type Values Removed Values Added
References () https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm - Not Applicable () https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm - Not Applicable
References () https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126 - Product () https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126 - Product
References () https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf - Patch () https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf - Patch
References () https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2 - Vendor Advisory () https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2 - Vendor Advisory
References () https://github.com/dan200/ComputerCraft/issues/170 - Issue Tracking () https://github.com/dan200/ComputerCraft/issues/170 - Issue Tracking
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 9.6

18 Jul 2023, 18:12

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References (MISC) https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf - (MISC) https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf - Patch
References (MISC) https://github.com/dan200/ComputerCraft/issues/170 - (MISC) https://github.com/dan200/ComputerCraft/issues/170 - Issue Tracking
References (MISC) https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm - (MISC) https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm - Not Applicable
References (MISC) https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2 - (MISC) https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2 - Vendor Advisory
References (MISC) https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126 - (MISC) https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126 - Product
CPE cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*

07 Jul 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-07 21:15

Updated : 2024-11-21 08:11

NVD link : CVE-2023-37262

Mitre link : CVE-2023-37262

CVE.ORG link : CVE-2023-37262

JSON object : View

Products Affected

tweaked

  • cc-tweaked
CWE
CWE-918

Server-Side Request Forgery (SSRF)