CVE-2020-5742: plex media server – CVSS 8.8

パッケージ	影響を受けるバージョン	修正済みバージョン
media server plex	`< 2020-06-15`	`2020-06-15`

概要

Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.

CVE-2026-96656高 7.2悪用確認済み（CISA KEV）Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH…
CVE-2026-96655中 4.3悪用確認済み（CISA KEV）Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/tra…
CVE-2026-96654中 6.5悪用確認済み（CISA KEV）Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other p…
CVE-2026-96652中 4.3悪用確認済み（CISA KEV）Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in…
CVE-2026-96651中 6.5Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path travers…