CVE-2024-52054

Application Creation Path Traversal in Wowza Streaming Engine

State: Published
Severity: 5.1 Medium
Published: Nov 21, 2024
Updated: Nov 21, 2024
Reserved: Nov 5, 2024

Description

Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	rapid7

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Streaming EngineWowza	4.3.0 to before 4.9.1Affected

References

https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes
https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.