CVE-2023-32687: tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots…

PriorityP335medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.63%

45.8th percentile

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tgstation	tgstation-server	—	—
tgstation13	tgstation-server	>= 4.7.0 < 5.12.1	5.12.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.