PT-2024-8650 · Wowza · Wowza Streaming Engine

Ryan Emmons · Published 2024-07-30 · Updated 2024-11-22 · CVE-2024-52053

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions prior to 4.9.1

Description The issue is related to Stored Cross-Site Scripting in the Manager component, which allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard. This can lead to the automatic hijacking of admin accounts. The vulnerability is associated with a lack of protection for the web page structure, enabling a remote attacker to conduct a cross-site scripting (XSS) attack.

Recommendations For versions prior to 4.9.1, update to version 4.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Manager component to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-10242

CVE-2024-52053

Affected Products

Wowza Streaming Engine

References · 7

• https://bdu.fstec.ru/vul/2024-10242 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52053 · Vendor Advisory
• https://twitter.com/CVEnew/status/1859820193746194855 · Twitter Post
• https://noise.getoto.net/author/ryan-emmons · Note
• https://first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N · Note
• https://rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed · Note
• https://wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes · Note