CVE-2023-30859
Triton Project Triton ≤ 3.7.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:LSummary
CVE-2023-30859 is a high-severity Unprotected Primary Channel (CWE-419) vulnerability in Triton Project Triton. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked in the top 38% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35202
Vulnerability Data
Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the…
more
bungee bridge and the server will begin to broadcast the 'triton:main' plugin channel. Using this plugin channel you are able to send a payload packet containing a byte (2) and a string (any spigot command). This could be used to make yourself a server operator and be used to extract other user information through phishing (pretending to be an admin), many servers use essentials so the /geoip command could be available to them, etc. This could also be modified to allow you to set the servers language, set another players language, etc. This issue affects those who have bungee enabled in config. This issue has been fixed in version 3.8.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 2 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
TSCM employment uncovers unprotected primary channels that have been physically or technically compromised for surveillance.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication directly prevents use of an unprotected admin channel.
Enforcing least-privilege access on the channel mitigates the unprotected primary channel.
Protecting data-in-transit integrity and confidentiality secures the primary channel itself.
Network-level controls that block unauthorized logical access close the unprotected channel.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure authentication protects the primary channel from unauthorized use.
Privileged access rights directly restrict who can use the primary administrative channel.
Network security measures can help isolate or protect the primary channel.
Information access restriction limits exposure of the unprotected primary channel.
Security of network services can enforce protection on the primary channel.
Network segregation can isolate the primary channel from untrusted networks.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-419
- V-248823 OL 8 must not have the telnet-server package installed. prevents CWE-419
Oracle Linux 9 (1 rule)
- V-271707 OL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. prevents CWE-419