CVE-2023-37262 json
CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default
published 2023-07-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41180
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.
Patch / fix
- tweaked cc-tweaked 1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, 1.20.1-1.106.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- cc-tweaked CC-Tweaked
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf
patch
-
github.com
/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2
vendor-advisory
-
github.com
/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm
not-applicable
-
github.com
/dan200/ComputerCraft/issues/170
issue-tracking
-
github.com
/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/comput
product
Sources
- CVE List CVE-2023-37262
- NVD CVE-2023-37262
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.