CVE-2016-20034highCWE-352

Wowza Streaming Engine 4.5.0 Privilege Escalation via user edit

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.2%

probabilidad de explotación

0.2%top 89% de las CVE

explotación observada

noninguna fuente lo reporta

Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipulating POST parameters. Attackers can send POST requests to the user edit endpoint with accessLevel set to 'admin' and advUser parameters set to 'true' and 'on' to gain administrative access.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Wowza Media Systems, LLC. · Wowza Streaming Engine

Referencias

https://www.exploit-db.com/exploits/40133 https://www.vulncheck.com/advisories/wowza-streaming-engine-privilege-escalation-via-user-edit http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5340.php