PT-2019-9793 · Wowza · Wowza Streaming Engine

Sean Melia · Publicado 2019-03-18 · Atualizado 2023-01-20 · CVE-2018-19365

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine version 4.7.4.01

Description The issue allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. This is related to the REST API in Wowza Streaming Engine.

Recommendations For Wowza Streaming Engine version 4.7.4.01, consider restricting access to the REST API to minimize the risk of exploitation. As a temporary workaround, limit the ability to traverse the directory structure and retrieve files via remote HTTP requests until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-19365

Produtos afetados

Wowza Streaming Engine

Referências · 5

• 🔥 https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html · Exploit
• https://t.me/cvenotify/42546 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-19365 · Nota de Segurança
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt · Nota
• https://osv.dev/vulnerability/CVE-2018-19365 · Aviso do Fabricante