CVE-2016-20034

HIGH

8.8

Descricao

Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipulating POST parameters. Attackers can send POST requests to the user edit endpoint with accessLevel set to 'admin' and advUser parameters set to 'true' and 'on' to gain administrative access.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado3/16/2026

Ultima modificacao3/19/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

wowza:streaming_engine

Fraquezas (CWE)

CWE-352

Referencias

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5340.php(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/40133(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/wowza-streaming-engine-privilege-escalation-via-user-edit(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.