← Zuruck zu CVEs

CVE-2023-32687

HIGH

7.7

Beschreibung

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

CVE Details

CVSS v3.1 Bewertung7.7

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht5/29/2023

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

tgstation13:tgstation-server

Schwachen (CWE)

CWE-522CWE-522

Referenzen

https://github.com/tgstation/tgstation-server/pull/1487(security-advisories@github.com)

https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1(security-advisories@github.com)

https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp(security-advisories@github.com)

https://github.com/tgstation/tgstation-server/pull/1487(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.