Cyber Resilience

CVE-2024-56141

Published
07 July 2026
Modified
08 July 2026
CVSS Score v3.1 5.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0011 2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-56141 is a medium-severity Generation of Predictable IV with CBC Mode (CWE-329) vulnerability. Its CVSS base score is 5.0 (Medium).

Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine ( CryptManager.kt ) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key…

more

rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available.

CWE(s)
CWE-329

Related Threats

CVEs Like This One

CVE-2024-49783Shared CWE-329
CVE-2025-2814Shared CWE-329
CVE-2026-45787Shared CWE-329

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V11.6.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce correct cryptographic implementation such as random IV generation for CBC.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography full match
prevents

Mandates proper cryptographic controls including IV generation, directly preventing predictable-IV CBC weaknesses.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect predictable IV usage before deployment.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC processes catch cryptographic flaws like bad IVs during design and review phases.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles guide selection of strong cryptographic primitives and IV handling.

A.8.28 Secure coding partial match
prevents

Requires secure coding practices that eliminate predictable IV usage in CBC implementations.

References