CVE-2022-24300

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.debian.org/1004223Mailing List, Patch, Third Party Advisory
https://github.com/minetest/minetest/commit/b5956bde259faa240a81060ff4e598e25ad52daePatch, Third Party Advisory
https://github.com/minetest/minetest/security/advisories/GHSA-hwj2-xf72-r4cfPatch, Third Party Advisory
https://www.debian.org/security/2022/dsa-5075Mailing List, Third Party Advisory
https://bugs.debian.org/1004223Mailing List, Patch, Third Party Advisory
https://github.com/minetest/minetest/commit/b5956bde259faa240a81060ff4e598e25ad52daePatch, Third Party Advisory
https://github.com/minetest/minetest/security/advisories/GHSA-hwj2-xf72-r4cfPatch, Third Party Advisory
https://www.debian.org/security/2022/dsa-5075Mailing List, Third Party Advisory

Timeline

Published: Feb 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-243016.5In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.CVE-2022-243025.9In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized inf CVE-2022-243039.1Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-243059.8Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.CVE-2022-243069.8Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.CVE-2022-243079.8Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (J CVE-2022-243085.5Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive infor CVE-2022-243098.1A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runt CVE-2022-24318.8The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i CVE-2022-243109.8A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and CVE-2022-243119.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file CVE-2022-243129.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file