CVE-2022-24300

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection

published February 2, 2022

CVSS
—
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

⚠️ A sneaky little bug in Minetest could let attackers modify item stack metadata like one too many cooks spoiling the broth! 🔥 Think of it like a restaurant that lets diners change the ingredients in their meals after they've already ordered — it could lead to some really weird combinations and spoil the entire dish! An attacker exploiting this vulnerability could tamper with item metadata, potentially causing confusion and chaos within the game. Imagine players suddenly wielding items with unexpected powers or attributes due to altered data, leading to gameplay imbalances and frustration.

Put simply

Think of it like a restaurant that lets diners change the ingredients in their meals after they've already ordered — it could lead to some really weird combinations and spoil the entire dish! This vulnerability allows attackers to inject or alter arbitrary metadata fields of item stacks by manipulating saved user inputs, leading to potential misuse of game items.

What to do

An attacker exploiting this vulnerability could tamper with item metadata, potentially causing confusion and chaos within the game. Imagine players suddenly wielding items with unexpected powers or attributes due to altered data, leading to gameplay imbalances and frustration. Patch to Minetest version 5.4.0 or higher to secure your server from this meta injection issue. Regularly audit your server’s configuration to ensure other vulnerabilities are also addressed. You've got this! Stay vigilant and keep your gaming world safe from these pesky bugs! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01674 · 76.7th percentile
Published
2022-02-02T06:01Z
EPSS history
Timeline
  • 02 FEB 06:01Z
    Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection
    cvelistv5