Improper File Permissions in Wowza Streaming Engine Configurations
CVE-2021-31540

7.1HIGH

Key Information:

Vendor

Wowza

Status
Streaming Engine
Vendor
CVE Published:
23 April 2021

What is CVE-2021-31540?

Wowza Streaming Engine, up to version 4.8.5, contains a vulnerability due to improper file permissions on configuration files located in the conf/ directory. This issue allows a regular local user to gain unauthorized access, enabling them to read and modify crucial configuration files that control the application server's behavior, potentially leading to significant security risks.

References

https://www.wowza.com/products/streaming-engine
x_refsource_MISC
https://www.gruppotim.it/redteam
x_refsource_MISC
https://www.wowza.com/docs/wowza-streaming-engine-4-8-12-...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.