CVE-2023-33198
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
tgstation-server is a tool for managing BYOND servers that may have an issue with the DreamMaker API chat channel cache. After a restart and reattach of tgstation-server, the cache can be poisoned, leading to chat messages being sent to configured IRC or Discord channels.
Risk Assessment
The organization may be exposed to unauthorized message sending to chat channels, which could lead to misinformation or privacy breaches for users.
Recommendation
It is recommended to monitor and update chat channels in tgstation-server and consider restarting DreamDaemon to minimize the risk associated with this vulnerability.
Original NVD description (English source)
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.