CVE-2020-9004 is a remote authenticated authorization-bypass vulnerability affecting Wowza Streaming Engine versions 4.8.0 and earlier. This flaw allows a read-only user to manipulate administrative functions, such as activating the Java JMX port in an unauthenticated mode. Successful exploitation could lead to arbitrary OS command execution with root privileges, posing a significant risk to system integrity. The vulnerability has a CVSS score of 8.8 (HIGH) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no public exploit intelligence or active exploitation has been reported, and community discussion is minimal, organizations using affected versions should upgrade to Wowza Streaming Engine 4.8.5 or later to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.8.0CPE matchmatch criteria | cpe:2.3:a:wowza:streaming_engine:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.