GitHub Advisoryadvisory · Packagist

GHSA-4m7v-wr6v-2mw5 AzuraCast missing brute force prevention

CRITICAL Published 2023-05-05 Modified 2023-05-11 Official page ↗
Aliases
CVE-2023-2531
Ecosystem
Packagist
Packages
azuracast/azuracast
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-307
Reviewed
2023-05-05

Affected packages

• Packagist azuracast/azuracast: < 0.18.3 → fixed in 0.18.3

Description

The request rate limiting feature on the login page of AzuraCast before version 0.18.3 can be bypassed, which could allow an attacker to brute force login credentials.

Related

Alias · CVE (1)

  • CVE-2023-2531 Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References