Vulnerability · Published Feb 2, 2022 · Assigned by mitre
CVE-2022-24300
Critical 9.8
In plain English
A critical-severity security flaw in the minetest package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | minetest | 5.4.1+repack-1 | DEBIAN-CVE-2022-24300 |
Affected products (as reported)
References
- https://bugs.debian.org/1004223 x_refsource_MISC
- https://github.com/minetest/minetest/commit/b5956bde259faa240a81060ff4e598e25ad52dae x_refsource_MISC
- https://github.com/minetest/minetest/security/advisories/GHSA-hwj2-xf72-r4cf x_refsource_MISC
- DSA-5075 vendor-advisory, x_refsource_DEBIAN