Vulnerability in Pmmp Pocketmine-Mp

CVE-2023-7332

PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.

EPSS: 0.004 (28.7th percentile) — read the EPSS interpretation.

Affected products

Pmmp Pocketmine-mp — versions 0

Weakness classification (CWE)

CWE-1284 — Improper Validation of Specified Quantity in Input

References

disclosure@vulncheck.com (release-notes, patch)
disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)