vulnwire
6.1med

CVE-2016-20036

Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities

Published 7 mo ago · modified 4 mo ago · JSON

CVSS
6.1
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 17%
Public exploits
0
none known

Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like appName, vhost, uiAppType, and wowzaCloudDestinationType in multiple endpoints to execute arbitrary HTML and JavaScript in a user's browser session.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction (EPSS)

0.25% probability of exploitation in the next 30 days, higher than 17% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA3.16.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.16.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

  • Wowza Media Systems, LLC. Wowza Streaming Engine

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • exploit-db.com /exploits/40135 · exploit
  • zeroscience.mk /en/vulnerabilities/ZSL-2016-5343.php · vendor-advisory
  • vulncheck.com /advisories/wowza-streaming-engine-multiple-cross-site-scripting-vulnerabilities · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.