CVE Feed

    Dashboard / CVE / CVE-2023-32687

    CVE-2023-32687

    tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

    Published:May 29, 2023
    Last Modified:Jan 13, 2025
    EPS:May 29, 2023
    EPSS Score:0.00157
    CVSS Score:7.7

    Affected Products

    Vendor
    Tgstation13
    Product
    Tgstation-server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-21611 (CVSS 8.8) — tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to author…
    CVE-2024-41799 (CVSS 8.4) — tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users …
    CVE-2023-34243 (CVSS 5.8) — TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was register…
    CVE-2023-33198 (CVSS 6.1) — tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat chann…
    CVE-2020-16136 (CVSS 7.7) — In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any f…
    CVE-2018-17107 (CVSS 9.8) — In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allow…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High