PT-2021-24433 · Unknown · Pocketmine-Mp

Published 2021-12-16 · Updated 2021-12-16

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PocketMine-MP (affected versions not specified)

Description: The issue arises from the way operator permissions are checked using the Config->exists() function with lowercase=true. This allows a user to add their name to the ops.txt file with uppercase letters, making it impossible to remove their operator permissions using commands.

Recommendations: To address this issue, remove the offending lines from ops.txt manually. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

GHSA-J5QG-W9JG-3WG3

Affected Products

Pocketmine-Mp

References · 6

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/blob/4.0.3/changelogs/4.0.md#403 · Exploit
• https://osv.dev/vulnerability/GHSA-j5qg-w9jg-3wg3 · Vendor Advisory
• https://github.com/iTXTech/Genisys/issues/1188 · Note