Security readout for executives and security teams
Plain-English summary
Minecraft servers using vulnerable CC: Tweaked versions could let any player reach cloud metadata services from the server. On AWS, GCP, Azure, or similar hosting, that may expose sensitive cloud information and enable broader compromise. Fixed releases are available.
Executive priority
Treat as urgent for cloud-hosted Minecraft infrastructure because successful abuse may expose cloud credentials or metadata. Non-cloud or non-CC: Tweaked servers are lower priority, but should still be verified through inventory.
Technical view
This is CWE-918 SSRF in CC: Tweaked's HTTP API defaults. A player with normal access could trigger server-side requests to cloud metadata endpoints because those addresses were not blocked by default. Fixed versions add protection across supported Minecraft release lines.
Likely exposure
Exposure is most relevant for internet-accessible Minecraft servers running CC: Tweaked below the listed fixed versions, especially when hosted on major cloud providers with instance metadata services reachable from the server runtime.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation. The advisory indicates low-complexity, authenticated network exploitation by a player, with high confidentiality and integrity impact if cloud metadata is exposed.
Researcher notes
Affected ranges span multiple Minecraft branches before 1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, and 1.20.1-1.106.0. Evidence supports SSRF risk and fixed releases, but not active exploitation.
Mitigation direction
- Upgrade CC: Tweaked to the fixed version for the deployed Minecraft release line.
- Prioritize cloud-hosted servers on AWS, GCP, Azure, or similar providers.
- Review vendor guidance before relying on configuration-only mitigations.
- Restrict cloud metadata access according to cloud provider guidance where applicable.
- Audit exposed server credentials or tokens if vulnerable versions were cloud-hosted.
Validation and detection
- Inventory all Minecraft servers and installed CC: Tweaked versions.
- Compare versions against the affected ranges in the CVE record.
- Identify whether affected servers run on cloud infrastructure with metadata services.
- Confirm upgraded deployments use the fixed release for their Minecraft line.
- Review logs for unusual in-game HTTP access patterns, without assuming compromise.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-37262 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N3.15.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2CVE reference · x_refsource_CONFIRM
- https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cmCVE reference · x_refsource_MISC
- https://github.com/dan200/ComputerCraft/issues/170CVE reference · x_refsource_MISC
- https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddfCVE reference · x_refsource_MISC
- https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.