← Back

CVE-2021-33790

nvd nist
Published: May 31, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.

Affected (4)

Techreborn
1 product
Reborncore
Configuration A
4 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Techreborn
Reborncore
Up to 3.13.8
Reborncore
From 3.19.0 to 3.19.5
Reborncore
From 4.2.0 to 4.2.10
Reborncore
From 4.7.0 to 4.7.3
Running on/withPlatform Versions
Minecraft
Minecraft
All versions

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (6)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ProductThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductThird Party Advisory

Timeline

No history available yet.