CVE-2021-39177

Katalog CVE

CVSS 9.8 · Critical EPSS 1,4%

Kerentanan Improper Authentication pada geysermc geyser. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.

Rincian

Terbit di NVD

30 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 patch · advisory pihak ketiga
• https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858 patch · advisory pihak ketiga
• https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY advisory pihak ketiga