PT-2019-9793 · Wowza · Wowza Streaming Engine

Sean Melia · Published 2019-03-18 · Updated 2023-01-20 · CVE-2018-19365

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine version 4.7.4.01

Description The issue allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. This is related to the REST API in Wowza Streaming Engine.

Recommendations For Wowza Streaming Engine version 4.7.4.01, consider restricting access to the REST API to minimize the risk of exploitation. As a temporary workaround, limit the ability to traverse the directory structure and retrieve files via remote HTTP requests until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-19365

Affected Products

Wowza Streaming Engine

References · 5

• 🔥 https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19365 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19365 · Vendor Advisory
• https://t.me/cvenotify/42546 · Telegram Post
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt · Note