Medium severity · published Apr 20, 2023
CVE-2023-2191
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18
4.8
CVSS
0.5%
EPSS
No
On KEV
Description
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AZ
Azuracast · Azuracast
before 0.18.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2191
Patch
https://github.com/azuracast/azuracast/commit/24276cb4166b2057de73569ec33046a80a8bb437
Exploit
https://huntr.dev/bounties/0814f5f9-8b58-40e5-b08c-7c488947cf31
More from Azuracast
9.8
CVE-2023-2531
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3
8.8
CVE-2026-100856
AzuraCast before 0.23.6 Code Injection via Remote Relay Password
8.8
CVE-2026-100852
AzuraCast before 0.23.8 Command Injection via Streamer Username
8.8
CVE-2026-76836
AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
8.8
CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload