Cc Tweaked
Approved changes feed: RSS · Atom
cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:*part: a version: * update: *
| Vendor | Tweaked (50e0cb05-6a3b-589d-9cfb-411753af030d) |
|---|---|
| Product | Cc Tweaked (124d15f0-589e-5b5f-bd7e-b8d1b08525b9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | minecraft |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cc-tweaked/cc-tweaked |
purl2cpe | 2026-06-01 10:14:57.938032 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-37262 |
vulnerable | 2026-06-08 06:08:15.021660 |
CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default
CRITICAL (9.6)
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.
Published: 2023-07-07T20:17:42.919Z
Updated: 2024-11-19T18:38:16.768Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.