CVE-2023-38688CWE-311

twitch-tui's connection is not encrypted

High · published August 4, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2023-08-04T16:18Z
EPSS history
Timeline
  • 04 AUG 16:18Z
    twitch-tui's connection is not encrypted
    cvelistv5