Authenticated XSS Vulnerabilities in Wowza Streaming Engine by Wowza Media Systems
CVE-2019-7655

5.4MEDIUM

Key Information:

Vendor

Wowza

Status
Streaming Engine
Vendor
CVE Published:
29 January 2020

What is CVE-2019-7655?

Wowza Streaming Engine versions 4.8.0 and earlier are susceptible to multiple authenticated cross-site scripting (XSS) vulnerabilities. These vulnerabilities can be exploited through the 'customList[0].value' field in the server setup configuration or the 'host' field in the login form. An attacker could leverage these weaknesses to inject malicious scripts into the web application, potentially compromising user data and the integrity of the system. This issue was resolved in the later version 4.8.5.

References

https://www.wowza.com/pricing/installer
x_refsource_MISC
https://github.com/DrunkenShells/Disclosures/tree/master/...
x_refsource_MISC
https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-r...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.