CVE-2023-32687
High
Description
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.
SeverityHigh
CVSS7.7
Exploit probability—
ProductTgstation13 Tgstation-server
PublishedMay 29, 2023
First seenMay 29, 2023
Weakness typeCWE-522CWE-522
How to fix
Update
- tgstation13 tgstation-server5.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tgstation13 tgstation-server | 4.7.0 ≤ v < 5.12.1 | 5.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.