Detections
Analytics
SCA: security update for azuracast/azuracast (GHSA-9449-rphm-mjqr)
low Tenable Self-Hosted Container Security Plugin ID 436358
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an
API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-
facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's
operations can craft a custom HTTP request that would affect the contents of a station's database, without
revealing any internal information about the station. In order to carry out an attack, a malicious user
would need to know a valid SFTP station username and the coordinating internal filesystem structure. This
issue is fixed in version 0.23.2. (CVE-2025-67737)
See Also
Plugin Details
Severity: Low
ID: 436358
Version: Revision 1.13
Type: Local
Family: SCA Checks
Published: 12/11/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 2
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2025-67737
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.4
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/11/2025
Vulnerability Publication Date: 12/11/2025
Reference Information
CVE: CVE-2025-67737
cwe: CWE-862