AzuraCast station profile settings injection lets users take over Shoutcast broadcasting
Some users of a radio management program can take over broadcasts.
Summary
Users with only the station profile edit permission in the AzuraCast radio management program can change Shoutcast server settings and run commands. Versions 0.23.8 and earlier are affected.
Affected when
- logged-in user with the Manage station profile permission
What to do
No fixed version is named yet. If you run 0.23.8 or earlier, check that you run a newer version and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen