CVE-2016-20035: Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint
Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious web pages. Attackers can trick logged-in administrators into visiting a malicious site that submits POST requests to the user edit endpoint to create new admin accounts with arbitrary credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20035?
CVE-2016-20035 is classified as a medium severity vulnerability due to its nature of allowing administrative actions through CSRF.
How do I fix CVE-2016-20035?
To fix CVE-2016-20035, ensure you implement CSRF tokens and validate user sessions for administrative actions in Wowza Streaming Engine.
What versions of Wowza Streaming Engine are affected by CVE-2016-20035?
CVE-2016-20035 specifically affects Wowza Streaming Engine version 4.5.0.
What type of vulnerability is CVE-2016-20035?
CVE-2016-20035 is a cross-site request forgery (CSRF) vulnerability.
Who can be exploited by CVE-2016-20035?
CVE-2016-20035 can be exploited by attackers who trick logged-in administrators into visiting malicious websites.