CVE-2024-41565

Sept. 19, 2024, 4:19 p.m.

5.3
Medium

Description

JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index in JEI for Minecraft, which allows in-game item duplication.

Product(s) Impacted

Vendor Product Versions
Mezz
  • Justenoughitems
  • *

Weaknesses

CWE-129
Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

*CPE(s)

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a mezz justenoughitems / / / / / minecraft / /
a mezz justenoughitems / / / / / minecraft / /
a mezz justenoughitems / / / / / minecraft / /
a mezz justenoughitems / / / / / minecraft / /

References

https://gist.github.com/apple502j/05123abb1d1c89c31afde15a9b34e2ae
https://github.com/mezz/JustEnoughItems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873

Tags

cve@mitre.org
CWE-129
2024-08-28
CVE-2024-41565

CVSS Score

5.3 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Date

  • Published: Aug. 28, 2024, 5:15 p.m.
  • Last Modified: Sept. 19, 2024, 4:19 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.