CVE-2023-34243 (GCVE-0-2023-34243)
Vulnerability from cvelistv5 – Published: 2023-06-08 21:09 – Updated: 2025-01-06 19:27
VLAI?
Summary
TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.
Severity ?
5.8 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| tgstation | tgstation-server |
Affected:
>= 4.0.0, < 5.12.5
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:01:54.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph"
},
{
"name": "https://github.com/tgstation/tgstation-server/pull/1526",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tgstation/tgstation-server/pull/1526"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-34243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-06T19:27:12.277382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-06T19:27:20.871Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tgstation-server",
"vendor": "tgstation",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 5.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-08T21:09:14.628Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph"
},
{
"name": "https://github.com/tgstation/tgstation-server/pull/1526",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tgstation/tgstation-server/pull/1526"
}
],
"source": {
"advisory": "GHSA-w3jx-4x93-76ph",
"discovery": "UNKNOWN"
},
"title": "Windows user name disclosure in TGstation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-34243",
"datePublished": "2023-06-08T21:09:14.628Z",
"dateReserved": "2023-05-31T13:51:51.172Z",
"dateUpdated": "2025-01-06T19:27:20.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tgstation13:tgstation-server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.0.0.0\", \"versionEndExcluding\": \"5.12.5\", \"matchCriteriaId\": \"39BA735D-72FE-487B-88D4-7E6E2FBF1E39\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.\"}, {\"lang\": \"es\", \"value\": \"TGstation es un conjunto de herramientas para gestionar servidores BYOND de producci\\u00f3n. En las versiones afectadas, si un usuario de Windows estaba registrado en \\\"tgstation-server (TGS)\\\", un atacante pod\\u00eda descubrir su nombre de usuario forzando el endpoint de inicio de sesi\\u00f3n con una contrase\\u00f1a no v\\u00e1lida. Cuando se encontraba un inicio de sesi\\u00f3n de Windows v\\u00e1lido, se generaba una respuesta distinta. Este problema se ha solucionado en la versi\\u00f3n 5.12.5. Se recomienda a los usuarios que la actualicen. Los usuarios que no puedan actualizar pueden mitigar el problema limitando la velocidad de las llamadas a la API con un software que se sit\\u00fae delante de TGS en el canal HTTP, como por ejemplo fail2ban. \"}]",
"id": "CVE-2023-34243",
"lastModified": "2024-11-21T08:06:50.877",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\", \"baseScore\": 5.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
"published": "2023-06-08T22:15:09.437",
"references": "[{\"url\": \"https://github.com/tgstation/tgstation-server/pull/1526\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/tgstation/tgstation-server/pull/1526\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-307\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-34243\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-06-08T22:15:09.437\",\"lastModified\":\"2024-11-21T08:06:50.877\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.\"},{\"lang\":\"es\",\"value\":\"TGstation es un conjunto de herramientas para gestionar servidores BYOND de producci\u00f3n. En las versiones afectadas, si un usuario de Windows estaba registrado en \\\"tgstation-server (TGS)\\\", un atacante pod\u00eda descubrir su nombre de usuario forzando el endpoint de inicio de sesi\u00f3n con una contrase\u00f1a no v\u00e1lida. Cuando se encontraba un inicio de sesi\u00f3n de Windows v\u00e1lido, se generaba una respuesta distinta. Este problema se ha solucionado en la versi\u00f3n 5.12.5. Se recomienda a los usuarios que la actualicen. Los usuarios que no puedan actualizar pueden mitigar el problema limitando la velocidad de las llamadas a la API con un software que se sit\u00fae delante de TGS en el canal HTTP, como por ejemplo fail2ban. \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-307\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tgstation13:tgstation-server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0.0\",\"versionEndExcluding\":\"5.12.5\",\"matchCriteriaId\":\"39BA735D-72FE-487B-88D4-7E6E2FBF1E39\"}]}]}],\"references\":[{\"url\":\"https://github.com/tgstation/tgstation-server/pull/1526\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/tgstation/tgstation-server/pull/1526\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\", \"name\": \"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/tgstation/tgstation-server/pull/1526\", \"name\": \"https://github.com/tgstation/tgstation-server/pull/1526\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T16:01:54.352Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-34243\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-06T19:27:12.277382Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-06T19:27:16.484Z\"}}], \"cna\": {\"title\": \"Windows user name disclosure in TGstation\", \"source\": {\"advisory\": \"GHSA-w3jx-4x93-76ph\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"tgstation\", \"product\": \"tgstation-server\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 5.12.5\"}]}], \"references\": [{\"url\": \"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\", \"name\": \"https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/tgstation/tgstation-server/pull/1526\", \"name\": \"https://github.com/tgstation/tgstation-server/pull/1526\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-06-08T21:09:14.628Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-34243\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-06T19:27:20.871Z\", \"dateReserved\": \"2023-05-31T13:51:51.172Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-06-08T21:09:14.628Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…