| Package | Affected versions | Patched versions |
|---|---|---|
| media server | < 1.25.0.5282 | 1.25.0.5282 |
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free