CVE-2022-35978

Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0	Release Notes Vendor Advisory
https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13	Patch Third Party Advisory
https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-08-15 19:15

Updated : 2022-08-17 14:16

NVD link : CVE-2022-35978

Mitre link : CVE-2022-35978

CVE.ORG link : CVE-2022-35978

JSON object : View

Products Affected

minetest

minetest

CWE

NVD-CWE-noinfo CWE-693

Protection Mechanism Failure

{"id": "CVE-2022-35978", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 1.8}]}, "published": "2022-08-15T19:15:08.890", "references": [{"url": "https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0", "tags": ["Release Notes", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds."}, {"lang": "es", "value": "Minetest es un motor de juegos voxel de c\u00f3digo abierto que permite modificar y crear juegos f\u00e1cilmente. En **single player**, un mod puede establecer una configuraci\u00f3n global que controla el script Lua cargado para mostrar el men\u00fa principal. El script es cargado en cuanto sale de la sesi\u00f3n de juego. El entorno Lua en el que es ejecutado el men\u00fa no est\u00e1 aislado y puede interferir directamente con el sistema del usuario. Actualmente no se presentan mitigaciones conocidas."}], "lastModified": "2022-08-17T14:16:24.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "433136C9-13AD-4E1A-AC0E-47402B44EE79", "versionEndExcluding": "5.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}