PT-2023-23962 · Unknown · Tgstation-Server

Cyberboss · Publicado 2023-05-29 · Atualizado 2023-06-06 · CVE-2023-32687

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions tgstation-server versions 4.7.0 through 5.12.1

Description The issue allows instance users with the list chat bots permission to read chat bot connection strings without the required permission. This affects a significant number of devices, but the exact number is not specified. As a workaround, removing the list chat bots permission from users who should not have access to connection strings can mitigate the issue. It is also recommended to invalidate any previously stored credentials for safety.

Recommendations For versions 4.7.0 through 5.12.1, update to version 5.12.1 to resolve the issue. As a temporary workaround, consider removing the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2023-32687

GHSA-RV76-495P-G7CP

Produtos afetados

Tgstation-Server

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32687.json · Exploit
• https://github.com/tgstation/tgstation-server/pull/1487 · Correção
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp · Aviso do Fabricante
• https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1 · Nota
• https://osv.dev/vulnerability/CVE-2023-32687 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32687 · Nota de Segurança