CVE-2019-7654 Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding anot...
MediumCVSS 6.5
EPSS 0.85%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server->Users component. This issue was resolved in Wowza Streaming Engine 4.8.5.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Wowza Streaming Engine | <= 4.8.0 | No fix listed |
References
- github.com exploit third-party-advisory
- raw.githubusercontent.com third-party-advisory
- www.wowza.com release-notes vendor-advisory
- www.wowza.com vendor-advisory