Threats tagged 'ghsa-jv23-j2cr-92x9'

AzuraCast versions up to 0.23.8 contain a vulnerability where users without the Manage station broadcasting permission can manipulate the frontend_config.custom_config setting via the PUT /station/{id}/profile/edit endpoint. This allows an authenticated user with only Manage station profile permission to override critical Shoutcast configuration parameters such as adminpassword, password, and portbase, or inject arbitrary directives through newline characters. This vulnerability can lead to hijacking of the station's Shoutcast frontend.