ByteOS Network

NVD Vulnerability Details :

CVE-2023-33198

Modified

Source-security-advisories@github.com

Published At-30 May, 2023 | 05:15

Updated At-21 Nov, 2024 | 08:05

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

tgstation13>>tgstation-server>>Versions from 4.0.0(inclusive) to 5.12.2(exclusive)

cpe:2.3:a:tgstation13:tgstation-server:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-941	Secondary	security-advisories@github.com
NVD-CWE-Other	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/tgstation/tgstation-server/pull/1493	security-advisories@github.com	Patch Vendor Advisory
https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.2	security-advisories@github.com	Release Notes
https://github.com/tgstation/tgstation-server/security/advisories/GHSA-p2xj-w57r-6f5m	security-advisories@github.com	Patch Vendor Advisory
https://github.com/tgstation/tgstation-server/pull/1493	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.2	af854a3a-2127-422b-91ae-364da2661108	Release Notes
https://github.com/tgstation/tgstation-server/security/advisories/GHSA-p2xj-w57r-6f5m	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History