PT-2020-11250 · Wowza · Wowza Streaming Engine

Published 2020-01-29 · Updated 2022-10-14 · CVE-2019-7654

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions 4.8.0 and earlier Wowza Streaming Engine versions 4.7.7 through 4.7.8

Description The issue allows an administrator to be tricked into making unwanted changes, such as adding another admin user, by following a link. This can be done via the enginemanager/server/user/edit.htm endpoint in the Server->Users component.

Recommendations For Wowza Streaming Engine versions 4.8.0 and earlier, update to version 4.8.5 or later to resolve the issue. For Wowza Streaming Engine versions 4.7.7 through 4.7.8, update to version 4.8.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the enginemanager/server/user/edit.htm endpoint in the Server->Users component to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-7654

Affected Products

Wowza Streaming Engine

References · 7

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-Wowza · Exploit
• https://osv.dev/vulnerability/CVE-2019-7654 · Vendor Advisory
• https://wowza.com/pricing/installer · Vendor Advisory
• https://wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7654 · Security Note
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7654.txt · Note
• https://t.me/cvenotify/591 · Telegram Post