« Volver al listado

CVE-2026-45289

Estado: AplazadaMedia (5.3)—

CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol is partially missing validation for FULL type authentication tokens (Cloudburst/Protocol). This vulnerability impacts publicly accessible software depending on the affected versions of Protocol, specifically the EncryptionUtils methods to validate auth payloads for FULL type tokens. This issue has been patched in version 3.0.0.Beta12-20260420.182526-15.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Cloudburst — Cloudburst ProtocolAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45289",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45289",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T13:34:10.628391Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "CloudburstMC",
          "product": "Protocol",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.0.Beta12-20260420.182526-15"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T21:16:27.803",
  "references": [
    {
      "url": "https://github.com/CloudburstMC/Protocol/security/advisories/GHSA-g2fr-c75x-4hf9",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol is partially missing validation for FULL type authentication tokens (Cloudburst/Protocol). This vulnerability impacts publicly accessible software depending on the affected versions of Protocol, specifically the EncryptionUtils methods to validate auth payloads for FULL type tokens. This issue has been patched in version 3.0.0.Beta12-20260420.182526-15."
    },
    {
      "lang": "es",
      "value": "CloudburstMC Protocol es una biblioteca de protocolo para Minecraft Bedrock Edition. Antes de la versión 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol carece parcialmente de validación para tokens de autenticación de tipo FULL (Cloudburst/Protocol). Esta vulnerabilidad impacta al software de acceso público que depende de las versiones afectadas de Protocol, específicamente los métodos EncryptionUtils para validar las cargas útiles de autenticación para tokens de tipo FULL. Este problema ha sido parcheado en la versión 3.0.0.Beta12-20260420.182526-15."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "security-advisories@github.com"
}