VulnerabilityAnalyzed

CVE-2024-52055

Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file.

HIGH 8.2EPSS 0.99%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file.

CVSS 4.0: 8.2 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.99% probability · 60th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: wowza/streaming engine
Source: cve@rapid7.com

References

https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/Third Party Advisory
https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notesRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.