CVE-2021-35491

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine versions 4.8.11+5 through 4.8.13

Description: A Cross-Site Request Forgery (CSRF) issue allows a remote attacker to delete a user account via the "/enginemanager/server/user/delete.htm" API endpoint using the userName parameter. The application does not implement a CSRF token for the GET request.

Recommendations: For versions 4.8.11+5 through 4.8.13, update to Wowza Streaming Engine release 4.8.14 to resolve the issue. As a temporary workaround, consider restricting access to the "/enginemanager/server/user/delete.htm" API endpoint to minimize the risk of exploitation. Avoid using the userName parameter in the affected API endpoint until the issue is resolved.