[CVE-2023-54390] PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPac…

Descripción técnica

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

Puntuación CVSS

Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Debilidades (CWE)

CWE-1025

Fuente oficial

Publicado en NIST NVD.