CVE-2023-34243: falha de média gravidade em tgstation-server
Windows user name disclosure in TGstation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 0.5%
TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
tgstation · tgstation-serverCVEs relacionadas — tgstation-server
No mesmo produto, das mais perigosas para as menos.
CVE-2024-41799HIGHtgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned usersEPSS 1.2%CVE-2023-33198MEDIUMIncorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker APIEPSS 0.6%CVE-2023-32687HIGHInsufficiently Protected ChatBot Credentials in tgstation-serverEPSS 0.6%CVE-2025-21611HIGHtgstation-server's role authorization incorrectly OR'd with user's enabled statusEPSS 0.5%