Security News > 2023 > March > LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach
The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.
The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "Available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022.
The vulnerability in question is CVE-2020-5741, a deserialization flaw impacting Plex Media Server on Windows that allows a remote, authenticated attacker to execute arbitrary Python code in the context of the current operating system user.
"This issue allowed an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it," Plex said in an advisory released at the time.
The issue, which was discovered and reported to Plex by Tenable in March 2020, was addressed by Plex in version 1.19.3.2764 released on May 7, 2020.
"Unfortunately, the LastPass employee never upgraded their software to activate the patch," Plex said in a statement.
News URL
https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html
Related news
- Amazon confirms employee data breach after vendor hack (source)
- Fintech giant Finastra investigates data breach after SFTP hack (source)
- Free, France’s second largest ISP, confirms data breach after leak (source)
- Interbank confirms data breach following failed extortion, data leak (source)
- How to Effectively Manage a Data Breach (source)
- HIBP notifies 57 million people of Hot Topic data breach (source)
- US space tech giant Maxar discloses employee data breach (source)
- Bologna FC confirms data breach after RansomHub ransomware attack (source)
- Rhode Island confirms data breach after Brain Cipher ransomware attack (source)
- Texas Tech University System data breach impacts 1.4 million patients (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-05-08 | CVE-2020-5741 | Deserialization of Untrusted Data vulnerability in Plex Media Server Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. | 7.2 |