CVE-2021-31539

Опубликовано: 23 апр. 2021

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.

Ссылки

https://www.gruppotim.it/redteam
Exploit
Third Party Advisory
https://www.wowza.com/docs/wowza-streaming-engine-4-8-8-01-release-notes#breaking
Release Notes
Vendor Advisory
https://www.wowza.com/products/streaming-engine
Product
Vendor Advisory
https://www.gruppotim.it/redteam
Exploit
Third Party Advisory
https://www.wowza.com/docs/wowza-streaming-engine-4-8-8-01-release-notes#breaking
Release Notes
Vendor Advisory
https://www.wowza.com/products/streaming-engine
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wowza:streaming_engine:*:*:*:*:*:*:*:*

Версия до 4.8.8.01 (исключая)

EPSS

Процентиль: 6%

0.00025

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-312

Связанные уязвимости

GHSA-8r89-3g9f-5g2p

github

больше 3 лет назад

Wowza Streaming Engine through 4.8.5 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.