CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-47765

Medium Severity
SVRS
30/100
CVSSv3
6.1/10
EPSS
0.00017/1

CVE-2024-47765 is a cross-site scripting (XSS) vulnerability in the Minecraft MOTD Parser PHP library. Specifically, the HtmlGenerator class is vulnerable to XSS attacks when parsing a malformed Minecraft server MOTD, allowing an attacker to inject malicious HTML into a web page. This occurs because the color and text properties of MotdItem objects are not properly filtered or escaped, enabling injection of arbitrary HTML code. Although the CVSS score is 6.1, the SVRS of 30 indicates a lower, but still existing, risk, suggesting that while the vulnerability exists, active exploitation in the wild is somewhat limited at this time. Successful exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript code in a user's browser. Users of the Minecraft MOTD Parser library should upgrade to version 1.0.6 to mitigate this risk. The library is used to display server MOTD (message of the day) information, and because of the reported XSS vulnerability, web pages displaying MOTD information using older versions of the library could be compromised.

TAGS
In The Wild
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:N
UI:R
S:C
C:L
I:L
A:N
PUBLICATION DATE2024-10-04
LAST MODIFIED2024-11-13
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-47765 is a cross-site scripting (XSS) vulnerability in Minecraft MOTD Parser, a PHP library used to parse Minecraft server messages of the day (MOTDs). An attacker can exploit this vulnerability by sending a malicious MOTD to a Minecraft server that is queried and passed to the HtmlGenerator. This allows the attacker to inject malicious HTML into a web page during web page generation.

Key Insights

  • The vulnerability is rated as low severity (CVSS: 0) by CVSS, but SOCRadar's SVRS assigns it a score of 30, indicating a moderate risk.
  • The vulnerability is exploitable through a web-based attack vector.
  • The vulnerability is not currently being exploited in the wild.

Mitigation Strategies

  • Update to Minecraft MOTD Parser version 1.0.6 or later.
  • Implement input validation and filtering to prevent malicious HTML from being injected into web pages.
  • Use a web application firewall (WAF) to block malicious requests.

Additional Information

  • This vulnerability is not associated with any known threat actors or APT groups.
  • CISA has not issued a warning for this vulnerability.
  • If you have any further questions about this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-47765 | jgniecki MinecraftMotdParser up to 1.0.5 HtmlGenerator cross site scripting (GHSA-q898-frwq-f3qp)
vuldb.com2025-03-08
CVE-2024-47765 | jgniecki MinecraftMotdParser up to 1.0.5 HtmlGenerator cross site scripting (GHSA-q898-frwq-f3qp) | A vulnerability was found in jgniecki MinecraftMotdParser up to 1.0.5 and classified as problematic. Affected by this issue is the function HtmlGenerator. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-47765. The attack may be launched remotely. There is no exploit available
vuldb.com
rss
forum
news

Social Media

CVE-2024-47765 Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack through a par… https://t.co/7A3DNU4uOL
0
1
1

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://github.com/jgniecki/MinecraftMotdParser/commit/b0ab9d68a964cd3d74977f39a9e7af0a94509f7c
[email protected]https://github.com/jgniecki/MinecraftMotdParser/security/advisories/GHSA-q898-frwq-f3qp
GITHUBhttps://github.com/jgniecki/MinecraftMotdParser/security/advisories/GHSA-q898-frwq-f3qp

CWE Details

CWE IDCWE NameDescription
CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence