What is CVE-2023-38688?

CVE-2023-38688 is a high-severity vulnerability in Xithrius Twitch-Tui, classified under Missing Encryption of Sensitive Data. CVSS score: 7.5/10. Published 2023-08-04.

How severe is CVE-2023-38688?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Xithrius Twitch-Tui

CVE-2023-38688

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

EPSS: 0.004 (35.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Xithrius Twitch-tui — versions < 2.4.1

Weakness classification (CWE)

CWE-311 — Missing Encryption of Sensitive Data

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Product, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-38688?: CVE-2023-38688 is a high-severity vulnerability in Xithrius Twitch-Tui, classified under Missing Encryption of Sensitive Data. CVSS score: 7.5/10. Published 2023-08-04.
How severe is CVE-2023-38688?: High severity. CVSS v3 base score is 7.5 out of 10.