CVE-2022-24300

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24300
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24300.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24300
Aliases
  • GHSA-hwj2-xf72-r4cf
Downstream
Published
2022-02-02T06:01:04Z
Modified
2026-08-12T13:00:00Z
Summary
[none]
Details

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24300.json"
}
References

Affected packages

Git / github.com/luanti-org/luanti

Affected ranges

Type
GIT
Repo
https://github.com/luanti-org/luanti
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f3e51dca155ce1d1062a339cf925f41d7c751df8
Fixed
b5956bde259faa240a81060ff4e598e25ad52dae
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.2.20110731_3
0.2.20110922
0.2.20110922_1
0.3.0
0.3.1
0.3.dev-20111021
0.4.0
0.4.1
0.4.10
0.4.11
0.4.13
0.4.14
0.4.15
0.4.16
0.4.2-rc1
0.4.3
0.4.4
0.4.8
0.4.9
0.4.dev-20111201-0
0.4.dev-20111202-1
0.4.dev-20111203-1
0.4.dev-20111203-2
0.4.dev-20111203-3
0.4.dev-20111204-1
0.4.dev-20111209-1
0.4.dev-20120106-1
0.4.dev-20120122-1
0.4.dev-20120318
0.4.dev-20120320
0.4.dev-20120326
0.4.dev-20120408
0.4.dev-20120603
0.4.dev-20120606
5.*
5.0.0
5.1.0
5.2.0
5.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24300.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53408133224196420866388612428380162363",
            "length": 196
        },
        "id": "CVE-2022-24300-1938ff24",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae",
        "target": {
            "file": "src/itemstackmetadata.cpp",
            "function": "ItemStackMetadata::setString"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "139091593272906886536187692800344746310",
                "147833175575904894199468214698151422506",
                "285130253436111299565579533393835422191",
                "136955139694349349319049353098607610634",
                "232826309761223626484778440077722443760",
                "229672279112784701421788494966258695778",
                "119741633168882156739549111384133518796",
                "59095601892421019714297209725059810961",
                "315452706849647259784930325093990111991",
                "220448486910237519561833148909854796795"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-24300-2edc632b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae",
        "target": {
            "file": "src/itemstackmetadata.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T13:00:00Z"