Security Resilience

CVE-2023-33198

Tgstation13 Tgstation-Server 4.0.0 – 5.12.2

Published
30 May 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 6.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS Score 0.0063 49th percentile
Risk Priority 46 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-33198 is a medium-severity Incorrectly Specified Destination in a Communication Channel (CWE-941) vulnerability in Tgstation13 Tgstation-Server. Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of…

more

the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.

CWE(s)
CWE-941NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1014 Rootkit Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
attack.mitre.org →
T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-34243Same product: Tgstation13 Tgstation-Server
CVE-2023-32687Same product: Tgstation13 Tgstation-Server
CVE-2025-21611Same product: Tgstation13 Tgstation-Server
CVE-2024-41799Same product: Tgstation13 Tgstation-Server
CVE-2024-34947Shared CWE-941
CVE-2025-69515Shared CWE-941
CVE-2025-53899Shared CWE-941
CVE-2026-40118Shared CWE-941
CVE-2024-29415Shared CWE-941
CVE-2026-69246Shared CWE-941

Affected Assets

tgstation13
tgstation-server
4.0.0 — 5.12.2

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-01 partial match
blocks

Network monitoring can detect traffic to wrong destinations but does not prevent the specification error itself.

ID.AM-03 partial match
blocks

Documented network data-flow diagrams directly reduce the chance of specifying an incorrect destination address.

PR.PS-01 partial match
blocks

Hardened configuration baselines and change control prevent mis-specified endpoints from being deployed.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.2 Physical entry partial match
removes
A.8.20 Networks security partial match
degrades

Network security controls enforce correct endpoint validation and routing, directly preventing mis-specified destinations.

A.8.21 Security of network services partial match
degrades

Security of network services includes service endpoint verification, mitigating incorrect destination specification.

A.8.25 Secure development life cycle partial match
blocks

Secure SDLC practices can catch destination errors during design, but coverage is indirect.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including those that could address destination validation) be identified and specified during development; it does not itself enforce, implement or prevent the incorrect destination flaw from remaining exploitable.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles encourage proper endpoint design, providing indirect mitigation.

References