Wowza Streaming Engine Manager RCE via XSS (CVE-2024-52052, CVE-2024-52053)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Wowza Streaming Engine (Fixed) - Vulnerability Type: Multiple vulnerabilities, including Cross-Site Scripting (XSS) attacks and remote code execution. - Affected Versions: Wowza Streaming Engine v4.9.1 and earlier versions. - Impact: Vulnerabilities exist in the Wowza Streaming Engine Manager web dashboard on both Linux and Windows platforms, allowing attackers to perform remote code execution. 2. Exploitation: - Attack Method: Unauthorized attackers can inject Cross-Site Scripting (XSS) payloads into the Wowza Streaming Engine Manager web dashboard. - Exploitation: When an administrator views the compromised dashboard, the authenticated vulnerability is automatically exploited to achieve remote code execution. 3. Remediation: - Fix Date: All vulnerabilities were patched on November 20, 2024, with the release of Wowza Streaming Engine v4.9.1. - Remediation Steps: Upgrade to Wowza Streaming Engine v4.9.1 or later to resolve these vulnerabilities. 4. Product Description: - Product Name: Wowza Streaming Engine - Product Type: Media server software - Product Use: Designed for live streaming, video on demand, closed captioning, and media system interoperability. 5. Credit: - Reporter: Ryan Emmons, Senior Security Researcher at Rapid7. - Disclosure Policy: Rapid7 disclosed the vulnerability in accordance with its vulnerability disclosure policy. 6. Vulnerability Details: - CVE IDs: Multiple CVEs, including CVE-2024-52052, CVE-2024-52053, etc. - Description: Includes remote code execution, file read, and file deletion vulnerabilities. - CVSS Score: Ranges from 6.9 to 9.4. 7. Vendor Statement: - Vendor: Wowza Media Systems - Statement: Committed to security excellence and collaborates with trusted researchers like Rapid7 to proactively address and remediate vulnerabilities to protect customer interests. 8. Mitigation: - Recommendation: Upgrade to Wowza Streaming Engine v4.9.1 or later to fix these vulnerabilities. This information provides a comprehensive overview of multiple vulnerabilities in Wowza Streaming Engine and outlines the necessary steps to remediate them by upgrading to the latest version.

Goal Reached Thanks to every supporter — we hit 100%!

Wowza Streaming Engine Manager RCE via XSS (CVE-2024-52052, CVE-2024-52053)