// For flags

CVE-2019-19141

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH.

La funcionalidad Camera Upload en Plex Media Server versiones hasta 1.18.2.2029, permite a usuarios autenticados remotos escribir archivos en cualquier lugar donde la cuenta de usuario que ejecuta Plex Media Server tenga permisos. Esto permite una ejecución de código remota por medio de una variedad de métodos, tal y como (en una instalación predeterminada de Ubuntu) crear una carpeta .ssh en el directorio de inicio del usuario de plex mediante el salto de directorio, cargando un archivo authorized_keys de SSH allí e iniciar sesión en el host como el usuario de Plex por medio de SSH.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-11-20 CVE Reserved
  • 2019-12-19 CVE Published
  • 2024-01-28 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://forums.plex.tv/t/security-camera-upload/507289 2021-07-21
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Plex
Search vendor "Plex"
 Media Server
Search vendor "Plex" for product "Media Server"
 <= 1.18.2.2029
Search vendor "Plex" for product "Media Server" and version " <= 1.18.2.2029"
-
Affected