PT-2023-20023 · Azuracast · Azuracast

CVE-2023-2531 · Publicado 2023-05-05 · Atualizado 2023-05-11

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.18.3

Description The issue is related to improper restriction of excessive authentication attempts in the AzuraCast GitHub repository. Specifically, the request rate limiting feature on the login page can be bypassed, allowing an attacker to brute force login credentials.

Recommendations For versions prior to 0.18.3, update to version 0.18.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the login page or implementing additional authentication measures until the update can be applied.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2023-2531

GHSA-4M7V-WR6V-2MW5

Produtos afetados

Azuracast

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2531.json · Exploit
• 🔥 https://huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02 · Exploit
• https://github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d · Correção
• https://github.com/azuracast/azuracast · Nota
• https://osv.dev/vulnerability/CVE-2023-2531 · Aviso do Fabricante
• https://t.me/cvenotify/49835 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2531 · Nota de Segurança
• https://t.me/cibsecurity/63348 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-4m7v-wr6v-2mw5 · Aviso do Fabricante