CVE-2016-20034

8.7 highEPSS 0.2%

Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipulating POST parameters. Attackers can send POST requests to the user edit endpoint with accessLevel set to 'admin' and advUser parameters set to 'true' and 'on' to gain administrative access.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.0 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2026-03-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wowza:streaming_engine

References

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5340.php
https://www.exploit-db.com/exploits/40133
https://www.vulncheck.com/advisories/wowza-streaming-engine-privilege-escalation-via-user-edit

Check your stack JSON