PT-2026-25732 · Wowza · Streaming Engine

CVE-2016-20034 · Publicado 2026-03-15 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine version 4.5.0

Description Wowza Streaming Engine 4.5.0 contains a condition that allows authenticated users with read-only access to gain administrative privileges. This is achieved by manipulating parameters within POST requests sent to the user edit endpoint. Specifically, attackers can set the accessLevel parameter to 'admin' and the advUser parameters to 'true' and 'on' to obtain administrative access.

Recommendations Apply any available updates or patches to address this issue. As a temporary workaround, restrict access to the user edit endpoint to prevent unauthorized modification of user privileges.

Exploit

Correção

LPE

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-20034

Produtos afetados

Streaming Engine

Referências · 5

• 🔥 https://exploit-db.com/exploits/40133 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2016-5340.php · Exploit
• https://t.me/CVEtracker/47452 · Publicação no Telegram
• https://vulncheck.com/advisories/wowza-streaming-engine-privilege-escalation-via-user-edit · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-20034 · Nota de Segurança