5.3med
CVE-2016-20035
Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint
Published 7 mo ago · modified 4 mo ago · JSON
CVSS
5.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 5%
Public exploits
0
none known
Summary
Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious web pages. Attackers can trick logged-in administrators into visiting a malicious site that submits POST requests to the user edit endpoint to create new admin accounts with arbitrary credentials.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction (EPSS)
0.16% probability of exploitation in the next 30 days, higher than 5% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected products
- Wowza Media Systems, LLC. Wowza Streaming Engine
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- exploit-db.com /exploits/40134 · exploit
- zeroscience.mk /en/vulnerabilities/ZSL-2016-5341.php · vendor-advisory
- vulncheck.com /advisories/wowza-streaming-engine-csrf-via-user-edit-endpoint · third-party-advisory
Sources
- CVE List: CVE-2016-20035
- NVD: CVE-2016-20035
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.