PT-2023-23962 · Unknown · Tgstation-Server

Cyberboss · Published 2023-05-29 · Updated 2023-06-06 · CVE-2023-32687

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions tgstation-server versions 4.7.0 through 5.12.1

Description The issue allows instance users with the list chat bots permission to read chat bot connection strings without the required permission. This affects a significant number of devices, but the exact number is not specified. As a workaround, removing the list chat bots permission from users who should not have access to connection strings can mitigate the issue. It is also recommended to invalidate any previously stored credentials for safety.

Recommendations For versions 4.7.0 through 5.12.1, update to version 5.12.1 to resolve the issue. As a temporary workaround, consider removing the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-32687

GHSA-RV76-495P-G7CP

Affected Products

Tgstation-Server

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32687.json · Exploit
• https://github.com/tgstation/tgstation-server/pull/1487 · Patch
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32687 · Security Note
• https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1 · Note