Vulnerability Details CVE-2019-19453
Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to insert a malicious payload that will be triggered in the main page of server settings. This issue was resolved in Wowza Streaming Engine 4.8.5.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.1%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
- https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-19453.txt
- https://www.gruppotim.it/redteam
- https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes
- https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-19453.txt
- https://www.gruppotim.it/redteam
- https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes
Products affected by CVE-2019-19453
-
cpe:2.3:a:wowza:streaming_engine:4.0.0
-
cpe:2.3:a:wowza:streaming_engine:4.0.1
-
cpe:2.3:a:wowza:streaming_engine:4.0.3
-
cpe:2.3:a:wowza:streaming_engine:4.0.4
-
cpe:2.3:a:wowza:streaming_engine:4.0.5
-
cpe:2.3:a:wowza:streaming_engine:4.0.6
-
cpe:2.3:a:wowza:streaming_engine:4.1.0
-
cpe:2.3:a:wowza:streaming_engine:4.1.1
-
cpe:2.3:a:wowza:streaming_engine:4.1.2
-
cpe:2.3:a:wowza:streaming_engine:4.2.0
-
cpe:2.3:a:wowza:streaming_engine:4.3.0
-
cpe:2.3:a:wowza:streaming_engine:4.4.0
-
cpe:2.3:a:wowza:streaming_engine:4.4.1
-
cpe:2.3:a:wowza:streaming_engine:4.5.0
-
cpe:2.3:a:wowza:streaming_engine:4.6.0
-
cpe:2.3:a:wowza:streaming_engine:4.7.0
-
cpe:2.3:a:wowza:streaming_engine:4.7.1
-
cpe:2.3:a:wowza:streaming_engine:4.7.3
-
cpe:2.3:a:wowza:streaming_engine:4.7.4
-
cpe:2.3:a:wowza:streaming_engine:4.7.4.0.1
-
cpe:2.3:a:wowza:streaming_engine:4.7.5
-
cpe:2.3:a:wowza:streaming_engine:4.7.6
-
cpe:2.3:a:wowza:streaming_engine:4.7.7
-
cpe:2.3:a:wowza:streaming_engine:4.7.8
-
cpe:2.3:a:wowza:streaming_engine:4.8.0