Vulnerabilities > CVE-2020-5741 - Deserialization of Untrusted Data vulnerability in Plex Media Server
Attack vector
NETWORK Attack complexity
LOW Privileges required
HIGH Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 | |
| OS | 1 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Windows |
| NASL id | PLEX_1_19_3.NASL |
| description | According to its self-reported version number, the version of Plex Media Server installed on the remote Windows host is prior to 1.19.3. It is, therefore, affected by an authenticated remote code execution vulnerability in the camera upload feature. An authenticated, remote attacker can exploit this, by uploading a malicious file via the camera upload feature, to cause arbitrary python code to be executed in the context of the current OS user.. Note that Nessus has not tested for these issues but has instead relied only on the application |
| last seen | 2020-06-12 |
| modified | 2020-06-11 |
| plugin id | 137326 |
| published | 2020-06-11 |
| reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/137326 |
| title | Plex Media Server < 1.19.3 Authenticated RCE |