CVE-2019-7656

Katalog CVE

CVSS 7.8 · High EPSS 0,45%

Kerentanan Incorrect Permission Assignment for Critical Resource pada wowza streaming engine. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5.

Rincian

Terbit di NVD

29 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes release notes · advisory vendor
• https://www.wowza.com/pricing/installer advisory vendor
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7656-PrivEscal-Wowza exploit · advisory pihak ketiga
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7656.txt advisory pihak ketiga