Cleartext Password Vulnerability in Wowza Streaming Engine by Wowza
CVE-2021-31539

5.5MEDIUM

Key Information:

Vendor

Wowza

Status
Streaming Engine
Vendor
CVE Published:
23 April 2021

What is CVE-2021-31539?

The Wowza Streaming Engine prior to version 4.8.8.01 suffers from a vulnerability where cleartext passwords are stored in the 'conf/admin.password' file. This flaw allows a regular local user to access sensitive administrative credentials, potentially compromising the security of the streaming service. Effective mitigation strategies involve upgrading to the latest version and ensuring robust access controls are implemented to prevent unauthorized access.

References

https://www.wowza.com/products/streaming-engine
x_refsource_MISC
https://www.gruppotim.it/redteam
x_refsource_MISC
https://www.wowza.com/docs/wowza-streaming-engine-4-8-8-0...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.