CVE-2020-9004

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5.

• CWE-306

• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-WowzaExploit, Third Party Advisory
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txtThird Party Advisory
• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease Notes, Vendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-WowzaExploit, Third Party Advisory
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txtThird Party Advisory
• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease Notes, Vendor Advisory

Published

Apr 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8998Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-8999Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9000An issue was discovered in iPortalis iCS 7.1.13.0. Attackers…7.5
• CVE-2020-9001Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9002An issue was discovered in iPortalis iCS 7.1.13.0. An attack…7.5
• CVE-2020-9003A stored XSS vulnerability exists in the Modula Image Galler…5.4
• CVE-2020-9005meshsystem.dll in Valve Dota 2 through 2020-02-17 allows rem…7.8
• CVE-2020-9006The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress…9.8
• CVE-2020-9007Codoforum 4.8.8 allows self-XSS via the title of a new topic…5.4
• CVE-2020-9008Stored Cross-site scripting (XSS) vulnerability in Blackboar…5.4
• CVE-2020-9009The ShipStation.com plugin 1.1 and earlier for CS-Cart allow…3.7
• CVE-2020-9012A cross-site scripting (XSS) vulnerability in the Import Peo…6.1