CVE-2024-58380

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.2-denial-of-service-via-bookeditpacket

Configurations

No configuration.

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de PocketMine-MP anteriores a la 5.11.2 contienen una vulnerabilidad de denegación de servicio en el manejo de BookEditPacket que provoca la caída del servidor cuando se proporciona un valor de ranura de inventario no válido. Los atacantes pueden enviar un BookEditPacket manipulado con una ranura de inventario mayor que 35 para activar una excepción no controlada y provocar la caída del servidor.

Information

Published : 2026-09-09 14:17

Updated : 2026-10-27 18:10

NVD link : CVE-2024-58380

Mitre link : CVE-2024-58380

CVE.ORG link : CVE-2024-58380

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2024-58380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58380", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T17:09:17.943196Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "pmmp", "product": "PocketMine-MP", "versions": [{"status": "affected", "version": "0", "lessThan": "5.11.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.11.2", "versionType": "semver"}], "packageURL": "pkg:composer/pocketmine/pocketmine-mp", "defaultStatus": "unaffected"}]}], "published": "2026-09-09T14:17:10.043", "references": [{"url": "https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.2-denial-of-service-via-bookeditpacket", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server."}, {"lang": "es", "value": "Las versiones de PocketMine-MP anteriores a la 5.11.2 contienen una vulnerabilidad de denegaci\u00f3n de servicio en el manejo de BookEditPacket que provoca la ca\u00edda del servidor cuando se proporciona un valor de ranura de inventario no v\u00e1lido. Los atacantes pueden enviar un BookEditPacket manipulado con una ranura de inventario mayor que 35 para activar una excepci\u00f3n no controlada y provocar la ca\u00edda del servidor."}], "lastModified": "2026-10-27T18:10:00.130", "sourceIdentifier": "disclosure@vulncheck.com"}