Vulnerability · Published May 29, 2023 · Assigned by GitHub_M

CVE-2023-32687Insufficiently Protected ChatBot Credentials in tgstation-server

High 7.7

In plain English

A high-severity security flaw in tgstation-server from tgstation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.6%top 49.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

Affected products (as reported)

Vendor	Product	Versions
tgstation	tgstation-server	>= 4.7.0, < 5.12.1

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp x_refsource_CONFIRM
https://github.com/tgstation/tgstation-server/pull/1487 x_refsource_MISC
https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1 x_refsource_MISC