CVE-2021-35491

published 2021-10-05

CVE-2021-35491: A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the…

Priority P3 35 high 8.1 CVSS 3.1

AV N AC L PR N UI R S U C N I H A H

A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolved in Wowza Streaming Engine release 4.8.14.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wowza	streaming_engine	< 4.8.14	4.8.14

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

nvd v2.0 5.8 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352