CVE-2024-52053: Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthent

This month

CRITICAL 9.6UPGRADE

CVE-2024-52053 is a critical-severity flaw (CVSS 9.6) affecting streaming engine. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts.

Why this priority

Critical severity

A fixed release or distro patch exists.

Risk facts

CVSS score	9.6 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.7% (top 48%)
CISA exploited list	No
Weakness	CWE-79
Published	2024-11-21
Last modified	2026-06-17

Publisher (CNA): Rapid7, Inc. · Vendor: wowza

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-11-21 23:15 UTCPublished CVE record published
2026-06-17 08:06 UTCUpdated Record last modified

wowza streaming engine UPGRADE

Affected: >= 4.3.0 and < 4.9.1

Fixed in: 4.9.1

Safe to downgrade to: a release before 4.3.0

1. Check installed version

apt-cache policy streaming-engine || rpm -q streaming-engine || streaming-engine --version

2. UPGRADE to 4.9.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade streaming-engine

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade streaming-engine

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 4.3.0 (Debian / Ubuntu)

apt-cache madison streaming-engine sudo apt install streaming-engine=<VERSION_BEFORE_4.3.0> sudo apt-mark hold streaming-engine

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list streaming-engine sudo dnf downgrade streaming-engine-<VERSION_BEFORE_4.3.0> sudo dnf versionlock add streaming-engine

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-52053?

streaming engine: upgrade to 4.9.1. Exact commands for each OS are on this page.

Is CVE-2024-52053 being exploited?

CVE-2024-52053 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-52053 affect?

CVE-2024-52053 affects streaming engine. Severity is critical (CVSS 9.6). Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts.

How urgent is CVE-2024-52053?

Priority 47/100. Critical severity

Related CVEs

CVE-2024-52056 MEDIUM 6.5 UPGRADE Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to
CVE-2024-52055 MEDIUM 4.9 UPGRADE Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to
CVE-2024-52054 LOW 2.7 UPGRADE Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to
CVE-2024-52052 HIGH 7.2 UPGRADE Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a
CVE-2016-20036 MEDIUM 6.1 DOWNGRADE Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the engineman

References

← Back to latest CVEs