CVE-2023-38689
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-38689 is a vulnerability affecting the Logistics Pipes mod for Minecraft Java Edition between 2013 and 2016. The issue stems from the mod's use of Java's `ObjectInputStream#readObject` on untrusted data, leading to potential remote code execution. Versions ranging from 0.7.0.91 to 0.10.0.71 are impacted, with an estimated total download volume in the millions. Users on Minecraft version 1.7.10 are advised to check and update their Logistics Pipes version, as the issue was fixed in build 0.10.0.71. Minecraft versions newer than 1.7.10 and any Logistics Pipes versions released for these versions are not affected. The most effective workarounds for vulnerable versions include playing in singleplayer mode or upgrading to newer Minecraft versions and modpacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions