CVE-2021-33806

Опубликовано: 03 июн. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization.

Ссылки

https://bdew.net
Release Notes
Vendor Advisory
https://github.com/bdew-minecraft/bdlib/commit/447210530ceec72fb3374efecb0930ed359d2297
Patch
Third Party Advisory
https://vuln.ryotak.me/advisories/46
Third Party Advisory
https://www.curseforge.com/minecraft/mc-mods/bdlib/files/3331330
Product
Third Party Advisory
https://bdew.net
Release Notes
Vendor Advisory
https://github.com/bdew-minecraft/bdlib/commit/447210530ceec72fb3374efecb0930ed359d2297
Patch
Third Party Advisory
https://vuln.ryotak.me/advisories/46
Third Party Advisory
https://www.curseforge.com/minecraft/mc-mods/bdlib/files/3331330
Product
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bdew:bdlib:*:*:*:*:*:minecraft:*:*

Версия до 1.16.1.7 (исключая)

EPSS

Процентиль: 91%

0.06862

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-8ww6-p355-pvjq

github

больше 3 лет назад