CVE-2024-52052
Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.4
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.50%
- CWE
- CWE-646
- Published
- 2024-11-21
- Last modified
- 2026-03-13
Affected products
- Wowza Streaming Engine
Weakness type
Related vulnerabilities
- CVE-2026-45315 — Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
- CVE-2026-20172 — Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
- CVE-2025-30662 — Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following
- CVE-2025-41720 — Sauter: Arbitrary File Upload
- CVE-2025-58449 — Maho Vulnerable to Authenticated Remote Code Execution via File Upload
- CVE-2025-1889 — picklescan - Security scanning bypass via non-standard file extensions
- CVE-2024-38432 — Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
- CVE-2023-45599 — A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the...