Vulnerabilities > CVE-2020-5741 - Deserialization of Untrusted Data vulnerability in Plex Media Server

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

nessus

NVD

Published: 2020-05-08

Updated: 2024-11-21

Summary

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Part	Description	Count
Application	Plex Plex Media Server - Plex Media Server 0.9.9.2 Plex Media Server 1.13.2.5154 Plex Media Server 1.18.2.2029 Plex Media Server 1.18.2.2029-36236Cc4C Plex Media Server 1.19.1.2701	6
OS	Microsoft Microsoft Windows -	1

NASL family	Windows
NASL id	PLEX_1_19_3.NASL
description	According to its self-reported version number, the version of Plex Media Server installed on the remote Windows host is prior to 1.19.3. It is, therefore, affected by an authenticated remote code execution vulnerability in the camera upload feature. An authenticated, remote attacker can exploit this, by uploading a malicious file via the camera upload feature, to cause arbitrary python code to be executed in the context of the current OS user.. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-12
modified	2020-06-11
plugin id	137326
published	2020-06-11
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137326
title	Plex Media Server < 1.19.3 Authenticated RCE