by Kastro
Paper/Archive/CVE-2024-52052

CVE-2024-52052

Wowza Streaming Engine — Stream Target Remote Code Execution in Wowza Streaming Engine

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
37
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 42.6.426 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.

Affected

ProductAffectedFixed inSource
Streaming Engine4.3.0 – < 4.9.14.9.1CNA
streaming_engine< 4.9.14.9.1CISA-ADP

Scores by source

rapid7 (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwowza.com/docs/wowza-streaming-engine-4-9-1-release-notesrefrapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed