Inventorygui
Monthly
Item duplication in InventoryGui before version 1.6.5 affects any Bukkit/Spigot plugin whose GUI uses the library's GuiStorageElement and allows players to take items out of that element while the server's experimental Bundle item feature is enabled. An authenticated in-game player interacting with such a GUI can duplicate items, an integrity-only impact confined to in-game economy; there is no confidentiality or availability effect. No public exploit code was identified at time of analysis, EPSS is very low (0.22%, 12th percentile), and the vendor has released a patch in version 1.6.5 that primarily disables GuiStorageElement on servers older than Minecraft 1.21.9.
Item duplication in InventoryGui 1.6.1-SNAPSHOT and earlier allows authenticated players to duplicate items within chest GUIs on Bukkit/Spigot servers, but only when a plugin uses the library's GuiStorageElement and the experimental Bundle item feature is enabled on the server. The flaw resides in how collect-to-cursor actions on storage elements are processed, and it was fixed in version 1.6.2-SNAPSHOT via a commit that adds player context to storage updates. Exploitation requires an authenticated player interacting with the GUI (CVSS 4.3, PR:L), EPSS is low at 0.25%, and no public exploit has been identified at time of analysis; impact is confined to in-game item/economy integrity, not server compromise, data disclosure, or denial of service.
Item duplication in InventoryGui (a Bukkit/Spigot library for building chest-based GUIs) affects all versions up to and including 1.6.3-SNAPSHOT when a plugin uses the GuiStorageElement on a server that has the experimental Minecraft "Bundle" item feature enabled. An authenticated in-game player (CVSS vector PR:L, UI:R) who right-clicks a bundle item in such a GUI can cause items to be duplicated, resulting in a limited integrity impact; confidentiality and availability are not affected. The issue is confirmed only when both preconditions hold - the bundle experiment is turned on and the GUI is built with GuiStorageElement - so the practical risk is genuine but modest, and no public exploit code or active exploitation (no CISA KEV listing) has been identified at time of analysis; EPSS is a low 0.26% (16th percentile). A vendor fix exists in 1.6.4-SNAPSHOT (commit 00e684bd backported to 1.6.3-SNAPSHOT).
Item duplication in InventoryGui before version 1.6.5 affects any Bukkit/Spigot plugin whose GUI uses the library's GuiStorageElement and allows players to take items out of that element while the server's experimental Bundle item feature is enabled. An authenticated in-game player interacting with such a GUI can duplicate items, an integrity-only impact confined to in-game economy; there is no confidentiality or availability effect. No public exploit code was identified at time of analysis, EPSS is very low (0.22%, 12th percentile), and the vendor has released a patch in version 1.6.5 that primarily disables GuiStorageElement on servers older than Minecraft 1.21.9.
Item duplication in InventoryGui 1.6.1-SNAPSHOT and earlier allows authenticated players to duplicate items within chest GUIs on Bukkit/Spigot servers, but only when a plugin uses the library's GuiStorageElement and the experimental Bundle item feature is enabled on the server. The flaw resides in how collect-to-cursor actions on storage elements are processed, and it was fixed in version 1.6.2-SNAPSHOT via a commit that adds player context to storage updates. Exploitation requires an authenticated player interacting with the GUI (CVSS 4.3, PR:L), EPSS is low at 0.25%, and no public exploit has been identified at time of analysis; impact is confined to in-game item/economy integrity, not server compromise, data disclosure, or denial of service.
Item duplication in InventoryGui (a Bukkit/Spigot library for building chest-based GUIs) affects all versions up to and including 1.6.3-SNAPSHOT when a plugin uses the GuiStorageElement on a server that has the experimental Minecraft "Bundle" item feature enabled. An authenticated in-game player (CVSS vector PR:L, UI:R) who right-clicks a bundle item in such a GUI can cause items to be duplicated, resulting in a limited integrity impact; confidentiality and availability are not affected. The issue is confirmed only when both preconditions hold - the bundle experiment is turned on and the GUI is built with GuiStorageElement - so the practical risk is genuine but modest, and no public exploit code or active exploitation (no CISA KEV listing) has been identified at time of analysis; EPSS is a low 0.26% (16th percentile). A vendor fix exists in 1.6.4-SNAPSHOT (commit 00e684bd backported to 1.6.3-SNAPSHOT).