PT-2026-86777 · Pmmp+2 · Pocketmine-Mp+1

CVE-2022-51015

·

Publicado

2022-01-13

·

Atualizado

2026-09-07

CVSS v3.1
CVSS v4.0

7.1

Alta

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values (e.g. negative), specifically with START BREAK or CRACK BLOCK actions, or with a UseItemTransactionData (typically in InventoryTransactionPacket).

Patches

f126479c37ff00a717a828f5271cf8e821d12d6c

Workarounds

Using a plugin, cancel DataPacketReceiveEvent if the packet is PlayerActionPacket and the facing is outside the range 0-5 when receiving START BREAK or CRACK BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases.

For more information

If you have any questions or comments about this advisory:

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2022-51015
GHSA-XH99-HW7H-WF63

Produtos afetados

Pocketmine-Mp
Pocketmine/Pocketmine-Mp