CVE-2023-32687: tgstation13 tgstation-server

csirt@kutim:~/threat-intel/cve/CVE-2023-32687

CVSS 6.5 · Medium EPSS 0,63%

Kerentanan Insufficiently Protected Credentials pada tgstation13 tgstation-server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

Rincian

Terbit di NVD: 29 Mei 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-522: Insufficiently Protected Credentials
EPSS (30 hari): 0,63% peluang dieksploitasi; lebih tinggi dari 48,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tgstation13	tgstation-server	Versi 4.7.0 hingga sebelum 5.12.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp advisory vendor
https://github.com/tgstation/tgstation-server/pull/1487 patch
https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.