Vulnerability Details CVE-2023-37262
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 36.8%
CVSS Severity
CVSS v3 Score 9.6
References
- https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm
- https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126
- https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf
- https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2
- https://github.com/dan200/ComputerCraft/issues/170
- https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm
- https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126
- https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf
- https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2
- https://github.com/dan200/ComputerCraft/issues/170
Products affected by CVE-2023-37262
-
cpe:2.3:a:tweaked:cc-tweaked:-
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.81.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.81.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.82.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.82.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.82.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.82.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.83.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.83.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.84.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.85.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.85.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.85.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.86.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.86.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.86.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.87.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.88.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.89.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.89.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.12.2-1.89.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.13.2-1.82.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.13.2-1.82.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.13.2-1.83.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14-1.82.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.2-1.83.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.3-1.83.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.84.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.84.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.85.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.85.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.85.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.86.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.86.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.86.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.87.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.87.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.88.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.89.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.89.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.14.4-1.89.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.86.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.87.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.87.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.88.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.88.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.89.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.89.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.90.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.90.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.91.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.92.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.93.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.93.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.94.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.95.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.95.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.95.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.95.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.96.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.97.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.15.2-1.97.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.1-1.90.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.1-1.90.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.1-1.90.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.1-1.90.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.2-1.91.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.2-1.91.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.3-1.92.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.3-1.93.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.3-1.93.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.4-1.94.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.4-1.95.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.4-1.95.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.4-1.95.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.4-1.95.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.4-1.96.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.10
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.4
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.5
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.6
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.8
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.100.9
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.101.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.101.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.97.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.98.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.98.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.98.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.99.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.16.5-1.99.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.100.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.100.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.100.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.100.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.100.4
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.98.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.98.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.99.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.17.1-1.99.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.18-1.99.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.1-1.100.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.1-1.100.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.1-1.100.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.1-1.99.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.10
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.3
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.4
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.5
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.6
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.8
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.100.9
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.101.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.18.2-1.101.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.1-1.100.9
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.2-1.100.10
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.2-1.101.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.2-1.101.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.2-1.101.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.3-1.102.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.3-1.102.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.3-1.102.2
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.3-1.103.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.3-1.103.1
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.4-1.104.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.19.4-1.105.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.20.1-1.105.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.4.7-1.105.0
-
cpe:2.3:a:tweaked:cc-tweaked:1.4.7-1.105.1