Skip to main content

Reliance on File Name or Extension of Externally-Supplied File

CVE-2024-52052

High
9.4/10

Summary

Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-646 - Reliance on File Name or Extension of Externally-Supplied File

The software allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

References

Advisory Timeline

  • Published