PT-2025-54457 · Unknown · Pocketmine-Mp

Published 2023-06-06 · Updated 2026-01-02 · CVE-2023-7332

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.18.1

Description PocketMine-MP versions prior to 4.18.1 have an issue with how input is checked when handling inventory transactions. A remote attacker who has a valid player session can ask the server to drop more items than the player actually has in their hotbar. This can cause the server to crash, leading to a denial of service.

Recommendations Update to PocketMine-MP version 4.18.1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2023-7332

GHSA-H87R-F4VC-MCHV

Affected Products

Pocketmine-Mp

References · 15

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/5897476 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md#4181 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/58974765a68f63a9968a7ff3a06f584ff2ee08d2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7332 · Security Note
• https://osv.dev/vulnerability/GHSA-h87r-f4vc-mchv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-7332 · Vendor Advisory
• https://cve.org/cverecord?id=CVE-2023-7332 · Security Note
• https://twitter.com/VulmonFeeds/status/2006550707042685098 · Twitter Post
• https://t.me/CVEtracker/41128 · Telegram Post
• https://vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash · Note
• https://t.me/cveNotify/147555 · Telegram Post
• https://twitter.com/CVEnew/status/2006495357685891273 · Twitter Post