GHSA-7r36-jf3c-jhp4

Source

https://github.com/advisories/GHSA-7r36-jf3c-jhp4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7r36-jf3c-jhp4/GHSA-7r36-jf3c-jhp4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7r36-jf3c-jhp4

Withdrawn

2023-06-09T22:54:40Z

Published

2022-05-13T01:50:31Z

Modified

2024-12-05T05:43:26Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references.

Original Description

In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-06-09T22:54:40Z",
    "nvd_published_at":  "2018-09-24T22:29:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

NuGet / TGServiceInterface

Package

Name: TGServiceInterface; View open source insights on deps.dev
Purl: pkg:nuget/TGServiceInterface

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2.1.0

Fixed

3.2.5.0

Affected versions

3.*

3.2.1

3.2.1.6

3.2.2

3.2.3.3

3.2.4

Database specific

last_known_affected_version_range

"<= 3.2.4.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7r36-jf3c-jhp4/GHSA-7r36-jf3c-jhp4.json"