PT-2023-25384 · Unknown · Fastasyncworldedit

Supermonis · Publicado 2023-06-22 · Atualizado 2023-07-03 · CVE-2023-35925

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FastAsyncWorldEdit versions prior to 2.6.3

Description This issue enables an attacker to select a region with the Infinity keyword and execute any operation, potentially bringing the server down. The attacker can exploit this by selecting a position with the Infinity keyword via commands like //pos2 Infinity and then executing further operations.

Recommendations For versions prior to 2.6.3, update FastAsyncWorldEdit to version 2.6.3 as soon as possible to address the vulnerability. As a temporary workaround, consider restricting the use of the Infinity keyword in position selection commands until the update is applied. Additionally, users with access to server logs can try to identify possible abuses of this issue by searching for the regex query //pos[12] Infinity in the logs.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-35925

GHSA-WHJ9-M24X-QHHP

Produtos afetados

Fastasyncworldedit

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35925.json · Exploit
• https://github.com/IntellectualSites/FastAsyncWorldEdit/security/advisories/GHSA-whj9-m24x-qhhp · Aviso do Fabricante
• https://github.com/IntellectualSites/FastAsyncWorldEdit/pull/2285 · Correção
• https://github.com/IntellectualSites/FastAsyncWorldEdit · Nota
• https://github.com/IntellectualSites/FastAsyncWorldEdit/releases/tag/2.6.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35925 · Nota de Segurança
• https://t.me/cvenotify/53595 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-whj9-m24x-qhhp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-35925 · Aviso do Fabricante