CVE-2023-33198 MEDIUM

CVE-2023-33198: Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

Vendor Tgstation

Product tgstation-server

Weakness CWE-941

Published May 30, 2023

Last update January 10, 2025

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.

Key dates

02Disclosure timeline

May 30, 2023 CVE published

January 10, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-33198 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/941.html