Hijacking Admin Accounts via Stored Cross-Site Scripting
CVE-2024-52053

9.6CRITICAL

Key Information:

Vendor

Wowza

Status
Streaming Engine
Vendor
CVE Published:
21 November 2024

What is CVE-2024-52053?

The Manager component of Wowza Streaming Engine prior to version 4.9.1 is susceptible to a stored Cross-Site Scripting vulnerability. This flaw allows an unauthenticated attacker to inject malicious client-side JavaScript into the web dashboard, potentially leading to unauthorized account access and hijacking of admin accounts. Mitigation is strongly advised through upgrading to a secure version.

References

https://www.rapid7.com/blog/post/2024/11/20/multiple-vuln...
https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-r...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.