{"containers": {"cna": {"affected": [{"product": "McWebserver", "vendor": "J-onasJones", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "descriptions": [{"lang": "en", "value": "McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-20T23:25:08.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/J-onasJones/McWebserver/pull/1"}], "source": {"advisory": "GHSA-gcvq-42cx-r46q", "discovery": "UNKNOWN"}, "title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-39221", "STATE": "PUBLIC", "TITLE": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "McWebserver", "version": {"version_data": [{"version_value": "< 0.2.0"}]}}]}, "vendor_name": "J-onasJones"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q", "refsource": "CONFIRM", "url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q"}, {"name": "https://github.com/J-onasJones/McWebserver/pull/1", "refsource": "MISC", "url": "https://github.com/J-onasJones/McWebserver/pull/1"}]}, "source": {"advisory": "GHSA-gcvq-42cx-r46q", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:00:43.569Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/J-onasJones/McWebserver/pull/1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T15:51:18.455659Z", "id": "CVE-2022-39221", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:56:47.480Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-39221", "datePublished": "2022-09-20T23:25:08.000Z", "dateReserved": "2022-09-02T00:00:00.000Z", "dateUpdated": "2025-04-23T16:56:47.480Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/J-onasJones/McWebserver/pull/1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:00:43.569Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-39221", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T15:51:18.455659Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T15:51:20.191Z"}}], "cna": {"title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod", "source": {"advisory": "GHSA-gcvq-42cx-r46q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "J-onasJones", "product": "McWebserver", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "references": [{"url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/J-onasJones/McWebserver/pull/1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-09-20T23:25:08.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, "source": {"advisory": "GHSA-gcvq-42cx-r46q", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< 0.2.0"}]}, "product_name": "McWebserver"}]}, "vendor_name": "J-onasJones"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q", "name": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q", "refsource": "CONFIRM"}, {"url": "https://github.com/J-onasJones/McWebserver/pull/1", "name": "https://github.com/J-onasJones/McWebserver/pull/1", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-39221", "STATE": "PUBLIC", "TITLE": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-39221", "state": "PUBLISHED", "dateUpdated": "2025-04-23T16:56:47.480Z", "dateReserved": "2022-09-02T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-09-20T23:25:08.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcwebserver_minecraft_mod_for_fabric_and_quilt_project:mcwebserver_minecraft_mod_for_fabric_and_quilt:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F306A99-7651-4465-AFB6-EA701128C31F", "versionEndIncluding": "0.1.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcwebserver_minecraft_mod_for_forge_project:mcwebserver_minecraft_mod_for_forge:*:*:*:*:*:*:*:*", "matchCriteriaId": "E15565A5-A3C8-4483-AFAE-5783934E3C19", "versionEndIncluding": "0.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory."}, {"lang": "es", "value": "McWebserver mod ejecuta un simple servidor HTTP junto con el servidor de Minecraft en hilos separados. UnSalto de Ruta en McWebserver Minecraft Mod para Fabric y Quilt versiones hasta 0.1.2.1 incluy\u00e9ndola y McWebserver Minecraft Mod para Forge versiones hasta 0.1.1 incluy\u00e9ndola, permite que todos los archivos, accesibles por el programa, sean le\u00eddos por cualquiera por medio de una petici\u00f3n HTTP. La versi\u00f3n 0.2.0 con parches son liberadas a ambas plataformas (Fabric y Quilt, Forge). Como mitigaci\u00f3n, el mod McWebserver puede ser deshabilitado al eliminar el archivo del directorio \"mods\""}], "id": "CVE-2022-39221", "lastModified": "2024-11-21T07:17:49.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-21T00:15:10.607", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/J-onasJones/McWebserver/pull/1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/J-onasJones/McWebserver/pull/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}