VulnerabilityModified

CVE-2024-41565

JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability.

MEDIUM 5.3EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index in JEI for Minecraft, which allows in-game item duplication.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.31% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-129, CWE-20
Affected: mezz/justenoughitems
Source: cve@mitre.org

References

https://gist.github.com/apple502j/05123abb1d1c89c31afde15a9b34e2aeThird Party Advisory
https://github.com/mezz/JustEnoughItems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.