CVE-2025-62783

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62783", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-22T18:55:48.008Z", "datePublished": "2025-10-27T20:54:36.254Z", "dateUpdated": "2025-10-28T14:32:27.050Z"}, "containers": {"cna": {"title": "InventoryGui affected by item duplication in GUIs which use GuiStorageElement", "problemTypes": [{"descriptions": [{"cweId": "CWE-837", "lang": "en", "description": "CWE-837: Improper Enforcement of a Single, Unique Action", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-598q-jw82-5w66", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-598q-jw82-5w66"}, {"name": "https://github.com/Phoenix616/InventoryGui/issues/48", "tags": ["x_refsource_MISC"], "url": "https://github.com/Phoenix616/InventoryGui/issues/48"}, {"name": "https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029", "tags": ["x_refsource_MISC"], "url": "https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029"}], "affected": [{"vendor": "Phoenix616", "product": "InventoryGui", "versions": [{"version": "< 1.6.2-SNAPSHOT", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-27T20:54:36.254Z"}, "descriptions": [{"lang": "en", "value": "InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT."}], "source": {"advisory": "GHSA-598q-jw82-5w66", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-28T14:31:23.528723Z", "id": "CVE-2025-62783", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-28T14:32:27.050Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-28T14:31:23.528723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-28T14:32:18.060Z"}}], "cna": {"title": "InventoryGui affected by item duplication in GUIs which use GuiStorageElement", "source": {"advisory": "GHSA-598q-jw82-5w66", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Phoenix616", "product": "InventoryGui", "versions": [{"status": "affected", "version": "< 1.6.2-SNAPSHOT"}]}], "references": [{"url": "https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-598q-jw82-5w66", "name": "https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-598q-jw82-5w66", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Phoenix616/InventoryGui/issues/48", "name": "https://github.com/Phoenix616/InventoryGui/issues/48", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029", "name": "https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-837", "description": "CWE-837: Improper Enforcement of a Single, Unique Action"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-27T20:54:36.254Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62783", "state": "PUBLISHED", "dateUpdated": "2025-10-28T14:32:27.050Z", "dateReserved": "2025-10-22T18:55:48.008Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-27T20:54:36.254Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "InventoryGui", "vendor": "Phoenix616", "versions": [{"status": "affected", "version": "< 1.6.2-SNAPSHOT"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenix616:inventorygui:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD40256B-64C2-4920-92BF-7056F92444B4", "versionEndExcluding": "1.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT."}, {"lang": "es", "value": "InventoryGui es una biblioteca para crear GUIs de cofres para plugins de Bukkit/Spigot. Las versiones 1.6.1-SNAPSHOT y anteriores contienen una vulnerabilidad donde cualquier plugin que utilice el 'GuiStorageElement' puede permitir la duplicaci\u00f3n de \u00edtems cuando la caracter\u00edstica experimental de \u00edtems Bundle est\u00e1 habilitada en el servidor. La vulnerabilidad se resuelve en la versi\u00f3n 1.6.2-SNAPSHOT."}], "id": "CVE-2025-62783", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62783", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-28T14:31:23.528723Z", "version": "2.0.3"}}]}, "published": "2025-10-27T21:15:38.450", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/Phoenix616/InventoryGui/issues/48"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-598q-jw82-5w66"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-837"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-28T10:24:04.882112+00:00", "updated": "2025-10-28T10:24:04.882139+00:00", "vendors": ["inventorygui", "inventorygui$PRODUCT$inventorygui"]}