CVE-2023-33198

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/tgstation/tgstation-server/pull/1493	Patch Vendor Advisory
https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.2	Release Notes
https://github.com/tgstation/tgstation-server/security/advisories/GHSA-p2xj-w57r-6f5m	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tgstation13:tgstation-server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-30 05:15

Updated : 2023-06-05 16:45

NVD link : CVE-2023-33198

Mitre link : CVE-2023-33198

CVE.ORG link : CVE-2023-33198

JSON object : View

Products Affected

tgstation13

tgstation-server

CWE

NVD-CWE-Other CWE-941

Incorrectly Specified Destination in a Communication Channel

{"id": "CVE-2023-33198", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.6}]}, "published": "2023-05-30T05:15:12.033", "references": [{"url": "https://github.com/tgstation/tgstation-server/pull/1493", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tgstation/tgstation-server/security/advisories/GHSA-p2xj-w57r-6f5m", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-941"}]}], "descriptions": [{"lang": "en", "value": "tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.\n"}], "lastModified": "2023-06-05T16:45:14.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tgstation13:tgstation-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE4AC7A1-7A9D-4546-A057-EDC58867C319", "versionEndExcluding": "5.12.2", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}