CVE-2020-9004 - A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality

Back Back to CVE browser

HIGH

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality

Published Apr 14, 2020

8.8

HIGH

CVSS 3.1

EPSS 3.53%

Description

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29835
Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-Wowza
x_refsource_MISCExploitThird Party Advisory
https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txt
x_refsource_MISCThird Party Advisory
https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29835		Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-Wowza		x_refsource_MISCExploitThird Party Advisory
https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txt		x_refsource_MISCThird Party Advisory
https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes		x_refsource_CONFIRMRelease NotesVendor Advisory