Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server
Critical severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jun 9, 2023
Withdrawn
This advisory was withdrawn on Jun 9, 2023
Package
Affected versions
>= 3.2.1.0, <= 3.2.4.0
Patched versions
3.2.5.0
Description
Published by the National Vulnerability Database
Sep 24, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jun 9, 2023
Withdrawn
Jun 9, 2023
Last updated
Jun 9, 2023
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references.
Original Description
In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.
References