Description
Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server->Users component. This issue was resolved in Wowza Streaming Engine 4.8.5.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://www.wowza.com/pricing/installer ↗
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-Wowza ↗
- https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes ↗
- https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7654.txt ↗