CVE-2016-20035 Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint
MediumCVSS 6.9
EPSS 0.18%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious web pages. Attackers can trick logged-in administrators into visiting a malicious site that submits POST requests to the user edit endpoint to create new admin accounts with arbitrary credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Wowza Media Systems, LLC. Wowza Streaming Engine | = 4.5.0 | No fix listed |
| Wowza Streaming Engine | = 4.5.0 | No fix listed |
References
- ExploitDB-40134 exploit third-party-advisory vdb-entry
- Vulnerability Advisory exploit third-party-advisory vendor-advisory
- VulnCheck Advisory: Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint third-party-advisory