VULNERABILITY INTELLIGENCE
CVE-2021-33790
CVSS score9.8 CRITICAL
EPSS probability2.84%
CISA KEVNot currently listed
Published2021-05-31
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.
Weakness classification
- CWE-502: Deserialization of Untrusted Data
Primary references
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Product, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Product, Third Party Advisory