CVE-2016-20034 - CVE House
Back to Database
Status published High CVE-2016-20034

Wowza Streaming Engine 4.5.0 Privilege Escalation via user edit

Vulnerability Description

Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipulating POST parameters. Attackers can send POST requests to the user edit endpoint with accessLevel set to 'admin' and advUser parameters set to 'true' and 'on' to gain administrative access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-20034

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • LiquidWorm as Gjoko Krstic of Zero Science Lab

References

More from Wowza Media Systems, LLC.

View All →
CVE-2016-20036
Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities
Medium 5.1
CVE-2016-20035
Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint
Medium 6.9
CVE-2016-20033
Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe
High 8.5

Affected Vendor

Wowza Media Systems, LLC.

View all reports →

Affected Software

Wowza Streaming Engine
Vulnerable Versions:
4.5.0

Timeline

Official Publish: March 15th, 2026
Last Modified: March 16th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact