CVE-2022-24300

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24300
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24300.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24300
Downstream
Related
  • GHSA-hwj2-xf72-r4cf
Published
2022-02-02T06:15:06Z
Modified
2025-10-16T05:13:18.000589Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.

References

Affected packages

Git / github.com/luanti-org/luanti

Affected ranges

Type
GIT
Repo
https://github.com/luanti-org/luanti
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b5956bde259faa240a81060ff4e598e25ad52dae
Type
GIT
Repo
https://github.com/minetest/minetest
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f3e51dca155ce1d1062a339cf925f41d7c751df8

Affected versions

0.*

0.2.20110731_3
0.2.20110922
0.2.20110922_1
0.3.0
0.3.1
0.3.dev-20111021
0.4.0
0.4.1
0.4.10
0.4.11
0.4.13
0.4.14
0.4.15
0.4.16
0.4.2-rc1
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.7-MSVC
0.4.8
0.4.9
0.4.dev-20111201-0
0.4.dev-20111202-1
0.4.dev-20111203-1
0.4.dev-20111203-2
0.4.dev-20111203-3
0.4.dev-20111204-1
0.4.dev-20111209-1
0.4.dev-20120106-1
0.4.dev-20120122-1
0.4.dev-20120318
0.4.dev-20120320
0.4.dev-20120326
0.4.dev-20120408
0.4.dev-20120603
0.4.dev-20120606

5.*

5.0.0
5.1.0
5.2.0
5.3.0

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 196.0,
                "function_hash": "53408133224196420866388612428380162363"
            },
            "target": {
                "function": "ItemStackMetadata::setString",
                "file": "src/itemstackmetadata.cpp"
            },
            "signature_type": "Function",
            "source": "https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2022-24300-1938ff24"
        },
        {
            "digest": {
                "line_hashes": [
                    "139091593272906886536187692800344746310",
                    "147833175575904894199468214698151422506",
                    "285130253436111299565579533393835422191",
                    "136955139694349349319049353098607610634",
                    "232826309761223626484778440077722443760",
                    "229672279112784701421788494966258695778",
                    "119741633168882156739549111384133518796",
                    "59095601892421019714297209725059810961",
                    "315452706849647259784930325093990111991",
                    "220448486910237519561833148909854796795"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "src/itemstackmetadata.cpp"
            },
            "signature_type": "Line",
            "source": "https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2022-24300-2edc632b"
        }
    ]
}