CVE-2023-34243
Medium
Description
TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.
SeverityMedium
CVSS5.8
Exploit probability40. percentile0.5%
ProductTgstation13 Tgstation-server
PublishedJun 8, 2023
First seenJun 8, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- tgstation13 tgstation-server5.12.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tgstation13 tgstation-server | 4.0.0.0 ≤ v < 5.12.5 | 5.12.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.