CVE-2023-38688

Katalog CVE

CVSS 7.5 · High EPSS 0,53%

Kerentanan Missing Encryption of Sensitive Data pada xithrius twitch-tui. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

Rincian

Terbit di NVD

4 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-311: Missing Encryption of Sensitive Data

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx advisory vendor
• https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a patch
• https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#... product