CVE-2023-34243 - CVE House

Back to Database

Status published Medium CVE-2023-34243

Windows user name disclosure in TGstation

5.8 CVSS

Vulnerability Description

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-34243

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from tgstation

View All →

tgstation-server's role authorization incorrectly OR'd with user's enabled status

tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

Insufficiently Protected ChatBot Credentials in tgstation-server

Affected Vendor

tgstation

View all reports →

Affected Software

tgstation-server

Vulnerable Versions:

>= 4.0.0, < 5.12.5

Timeline

Official Publish: June 8th, 2023

Last Modified: January 6th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel