PT-2023-20023 · Azuracast · Azuracast

Published 2023-05-05 · Updated 2023-05-11 · CVE-2023-2531

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.18.3

Description The issue is related to improper restriction of excessive authentication attempts in the AzuraCast GitHub repository. Specifically, the request rate limiting feature on the login page can be bypassed, allowing an attacker to brute force login credentials.

Recommendations For versions prior to 0.18.3, update to version 0.18.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the login page or implementing additional authentication measures until the update can be applied.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-2531

GHSA-4M7V-WR6V-2MW5

Affected Products

Azuracast

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2531.json · Exploit
• 🔥 https://huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02 · Exploit
• https://github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d · Patch
• https://osv.dev/vulnerability/CVE-2023-2531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2531 · Security Note
• https://osv.dev/vulnerability/GHSA-4m7v-wr6v-2mw5 · Vendor Advisory
• https://github.com/azuracast/azuracast · Note
• https://t.me/cvenotify/49835 · Telegram Post
• https://t.me/cibsecurity/63348 · Telegram Post