Vulnerability · Published Apr 14, 2020 · Assigned by mitre

CVE-2020-9004

High 8.8

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)3.5%top 10.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-Wowza x_refsource_MISC
https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes x_refsource_CONFIRM
https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txt x_refsource_MISC