Threats tagged 'ghsa-8x7j-92r4-99vr'

AzuraCast versions prior to 0.24.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows station users with WebHooks permission to bypass the UserUrlFilter protection via certain connectors, including Mastodon, Telegram, GroupMe, and RadioReg. Attackers can manipulate parameters such as instance_url, api, or webhookurl to target internal network addresses, including loopback, private networks, or cloud metadata services. The vulnerability has a medium severity rating with a CVSS score of 5.3.