Directory Traversal Vulnerability in Wowza Streaming Engine by Wowza Media Systems
CVE-2018-19365

9.1CRITICAL

Key Information:

Vendor

Wowza

Status
Streaming Engine
Vendor
CVE Published:
21 March 2019

What is CVE-2018-19365?

The REST API in Wowza Streaming Engine 4.7.4.01 has a vulnerability that permits an attacker to traverse the directory structure. By sending specially crafted HTTP requests, an unauthorized user can access sensitive files on the server, potentially leading to data exposure and exploitation. This poses significant risks if sensitive configurations or credentials are retrievable by exploiting this flaw.

References

https://blog.gdssecurity.com/labs/2019/2/11/wowza-streami...
x_refsource_MISC
https://raw.githubusercontent.com/WowzaMediaSystems/publi...
x_refsource_MISC

EPSS Score

22% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.