CVE-2016-20036: Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities
Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like appName, vhost, uiAppType, and wowzaCloudDestinationType in multiple endpoints to execute arbitrary HTML and JavaScript in a user's browser session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20036?
CVE-2016-20036 is classified as a high severity vulnerability due to its potential for allowing attackers to execute scripts in the context of a user’s session.
How do I fix CVE-2016-20036?
To fix CVE-2016-20036, ensure that you update Wowza Streaming Engine to the latest available version which addresses these cross-site scripting vulnerabilities.
What types of attacks can be executed using CVE-2016-20036?
Using CVE-2016-20036, attackers could exploit the vulnerability to perform reflected cross-site scripting attacks, potentially hijacking user sessions or stealing sensitive information.
Which versions of Wowza Streaming Engine are affected by CVE-2016-20036?
CVE-2016-20036 specifically affects Wowza Streaming Engine version 4.5.0.
Are there any preventive measures for CVE-2016-20036?
Preventive measures for CVE-2016-20036 include proper input validation and sanitization in web applications to mitigate the risk of cross-site scripting.