Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

tgserviceinterface

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.3NuGetPublished

    tgstation-server cached user logins in legacy server

    CVE-2018-17107 · GHSA-42r6-p4px-qvv6

    Affected
    • NuGet tgserviceinterface >= 3.2.1.0, <= 3.2.4.0
    Fixed in
    3.2.5.0· Vendor fix available
    Issue
    Please note this advisory is for a historical preexisting issue in the legacy server from 2018. It has long since been triaged. It is being moved here for visibility. The text below is copied from the original issue #690 You can login to the server with any username/password combination if someone else is logged in An explanation of the bug: Back in 3.2.1.0, in order to accommodate running the Control Panel using Mono some hooks were added to the WCF communication layer. Detailed in this commit: https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733 The bug was in this line: https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733R48 authPolicy is passed in by the framework but the documentation for what the parameter is is virtually non-existent:…

    Recommended action: Upgrade to 3.2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →