CVE-2023-37262
Description
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.
How to fix
- tweaked cc-tweaked1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, 1.20.1-1.106.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tweaked cc-tweaked | v < 1.16.5-1.101.3, 1.17.1-1.98.1 ≤ v < 1.18.2-1.101.3, 1.19.1-1.100.9 ≤ v < 1.19.2-1.101.3, 1.19.3-1.102.0 ≤ v < 1.19.4-1.106.0, 1.20.1-1.105.0 ≤ v < 1.20.1-1.106.0 | 1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, 1.20.1-1.106.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.