CVE-2021-35492: Medium severity wowza streaming engine vulnerability
Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager/server/vhost/historical.jsdata vhost parameter. This is due to the insufficient management of available filesystem resources. An attacker could exploit this vulnerability through the Virtual Host Monitoring section by requesting random virtual-host historical data and exhausting available filesystem resources. A successful exploit could allow the attacker to cause database errors and cause the device to become unresponsive to web-based management. (Manual intervention is required to free filesystem resources and return the application to an operational state.)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-35492?
CVE-2021-35492 is a vulnerability in Wowza Streaming Engine that could allow an authenticated remote attacker to exhaust filesystem resources.
How can an attacker exploit CVE-2021-35492?
An attacker can exploit CVE-2021-35492 by sending malicious requests to the /enginemanager/server/vhost/historical.jsdata vhost parameter.
What is the severity of CVE-2021-35492?
The severity of CVE-2021-35492 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2021-35492?
Wowza Streaming Engine versions up to and including 4.8.11 are affected by CVE-2021-35492.
Is there a fix available for CVE-2021-35492?
Yes, users should update to Wowza Streaming Engine version 4.8.14 or later to mitigate CVE-2021-35492.