How serious is CVE-2016-20035?

This vulnerability has a CVSS score of 6.9 out of 10, classified as MEDIUM severity. Proof-of-concept exploit code is publicly available, making this an active threat.

Is there exploit code available for CVE-2016-20035?

Yes, proof-of-concept exploit code for CVE-2016-20035 is publicly available on GitHub and security research platforms. This increases the risk of active exploitation.

Which products are affected by CVE-2016-20035?

CVE-2016-20035 affects wowza streaming engine. Check the full CVE details for specific version information.

How do I fix CVE-2016-20035?

To remediate CVE-2016-20035, check for security patches from wowza. Apply all available updates and security patches. If no patch is available, implement recommended workarounds or security controls to mitigate the risk.

CVE-2016-20035

Medium

|6.9

Exploit Available

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows attackers to create new admin accounts with any credentials by tricking logged-in administrators into visiting a malicious website. The attacker needs the administrator to be logged in to the Wowza Streaming Engine while visiting the malicious site, which then submits unauthorized requests on their behalf.

Technical Description

Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious web pages. Attackers can trick logged-in administrators into visiting a malicious site that submits POST requests to the user edit endpoint to create new admin accounts with arbitrary credentials.

CVSS Vector Analysis

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

Confidentiality ImpactHigh

Integrity ImpactHigh

Availability ImpactHigh

ScopeChanged

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit Resources

Search for proof-of-concept code and exploit modules

GitHub Search Exploit-DB Nuclei Templates Metasploit Vulners

Official References

NIST NVD

Est. Bounty

$1,000($500-$1K)

Vendor Response

Grade APatched in 2 days

Quick Information

Published

Mar 16, 2026

22 days ago

Last Modified

Mar 19, 2026

19 days ago

Vendor

wowza

Product

streaming engine

Related Vulnerabilities

CVE-2016-20036Medium

An attacker can inject harmful scripts into the Wowza Streaming Engine's management interface, allowing them to execute malicious code in a user's browser session. This vulnerability requires the attacker to manipulate specific input parameters, potentially tricking users into clicking on a link or visiting a page that exploits the flaw.

CVE-2016-20034High

This vulnerability allows an attacker with a read-only user account to gain full administrative access to the Wowza Streaming Engine by tricking the system into thinking they have higher privileges. The attacker simply needs to send a specially crafted request to the server, changing certain parameters to elevate their access level.

CVE-2016-20033High

This vulnerability allows an attacker with access to the Wowza Streaming Engine to replace important executable files with malicious ones, giving them the ability to run code with full system privileges when the services restart. The attacker can exploit this due to overly permissive file settings that let anyone modify these files.