CVE-2023-33198
Medium
Description
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.
SeverityMedium
CVSS6.1
Exploit probability—
ProductTgstation13 Tgstation-server
PublishedMay 30, 2023
First seenMay 30, 2023
Weakness typeCWE-941CWE-941
How to fix
Update
- tgstation13 tgstation-server5.12.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tgstation13 tgstation-server | 4.0.0 ≤ v < 5.12.2 | 5.12.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.