A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolved in Wowza Streaming Engine release 4.8.14.
References
| Link | Resource |
|---|---|
| https://n4nj0.github.io/advisories/wowza-streaming-engine-i/ | Third Party Advisory |
| https://www.gruppotim.it/redteam | Exploit Third Party Advisory |
| https://www.wowza.com/docs/wowza-streaming-engine-4-8-14-release-notes | Release Notes Vendor Advisory |
| https://n4nj0.github.io/advisories/wowza-streaming-engine-i/ | Third Party Advisory |
| https://www.gruppotim.it/redteam | Exploit Third Party Advisory |
| https://www.wowza.com/docs/wowza-streaming-engine-4-8-14-release-notes | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 06:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://n4nj0.github.io/advisories/wowza-streaming-engine-i/ - Third Party Advisory | |
| References | () https://www.gruppotim.it/redteam - Exploit, Third Party Advisory | |
| References | () https://www.wowza.com/docs/wowza-streaming-engine-4-8-14-release-notes - Release Notes, Vendor Advisory |
Information
Published : 2021-10-05 16:15
Updated : 2024-11-21 06:12
NVD link : CVE-2021-35491
Mitre link : CVE-2021-35491
CVE.ORG link : CVE-2021-35491
JSON object : View
Products Affected
wowza
- streaming_engine
CWE
CWE-352
Cross-Site Request Forgery (CSRF)