CSRF Vulnerabilities in Wowza Streaming Engine by Wowza Media Systems

CVE-2019-7654

What is CVE-2019-7654?

The Wowza Streaming Engine prior to version 4.8.5 is susceptible to multiple Cross-Site Request Forgery (CSRF) vulnerabilities. These weaknesses allow an attacker to deceive administrators into executing undesired actions. For instance, by enticing an admin to click on a malicious link, an attacker can make unauthorized changes, such as adding a new admin user via the enginemanager/server/user/edit.htm interface. This can lead to significant security risks if exploited. Upgrading to Wowza Streaming Engine 4.8.5 or later mitigates these vulnerabilities.

References