TI-2023-17079 Aliases CVE-2023-34243

Windows user name disclosure in TGstation

LOW 32CWE-200Published 2023-06-08 · Updated 2025-01-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-307.

Summary

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct response would be generated. This issue has been addressed in version 5.12.5. Users are advised to upgrade. Users unable to upgrade may be mitigated by rate-limiting API calls with software that sits in front of TGS in the HTTP pipeline such as fail2ban.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0046 40th percentileScored 2026-11-07

Fix Fixed tgstation-server (tgstation): 5.12.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tgstation	tgstation-server	4.0.0 to before 5.12.5	5.12.5	Patch available	CNA

tgstation-server Vendortgstation Affected 4.0.0 to before 5.12.5 Fixed in 5.12.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tgstation13:tgstation-server::::::::	4.0.0.0 to before 5.12.5	Vulnerable	tgstation

cpe:2.3:a:tgstation13:tgstation-server:*:*:*:*:*:*:*:* Versions 4.0.0.0 to before 5.12.5 Vulnerable ·tgstation

Remediation

Fix · CNA tgstation-server (tgstation) Fixed in 5.12.5

Timeline

2026-10-02 Threatist record created from CVE-2023-34243

References

Patch 1

https://github.com/tgstation/tgstation-server/pull/1526

Advisory 1

https://github.com/tgstation/tgstation-server/security/advisories/GHSA-w3jx-4x93-76ph

TI-2024-27844 Path traversal in tgstation-server CVSS 3.1CRITICAL 9.9
TI-2018-12228 In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins… CVSS 3.0CRITICAL 9.8
TI-2025-15571 tgstation-server's role authorization incorrectly OR'd with user's enabled status CVSS 3.1HIGH 8.8
TI-2020-12691 In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download… CVSS 3.1HIGH 7.7
TI-2023-15963 Insufficiently Protected ChatBot Credentials in tgstation-server CVSS 3.1HIGH 7.7
TI-2023-16375 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences