CVE-2024-47765

CVSS V2 None CVSS V3 None
Description
Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD. The HtmlGenerator iterates through objects of MotdItem that are contained in an object of MotdItemCollection to generate a HTML string. An attacker can make malicious inputs to the color and text properties of MotdItem to inject own HTML into a web page during web page generation. For example by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the HtmlGenerator. This XSS vulnerability exists because the values of these properties are neither filtered nor escaped. This vulnerability is fixed in 1.0.6.
Overview
  • CVE ID
  • CVE-2024-47765
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-10-04T14:20:24.412Z
  • Last Modified Date
  • 2024-10-04T16:09:22.623Z
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CWE-80 http://cwe.mitre.org/data/definitions/80.html
References
Reference URL Reference Tags
https://github.com/jgniecki/MinecraftMotdParser/security/advisories/GHSA-q898-frwq-f3qp x_refsource_CONFIRM
https://github.com/jgniecki/MinecraftMotdParser/commit/b0ab9d68a964cd3d74977f39a9e7af0a94509f7c x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-47765
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47765
History
Created Old Value New Value Data Type Notes
2024-10-07 03:33:58 Added to TrackCVE