Plex Media Server Multiple Security Vulnerabilities
BID:66783
Info
Plex Media Server Multiple Security Vulnerabilities
| Bugtraq ID: | 66783 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2014 12:00AM |
| Updated: | Feb 06 2014 12:00AM |
| Credit: | Stefan Viehböck |
| Vulnerable: |
Plex Plex Media Server 0.9.9.10 |
| Not Vulnerable: | |
Discussion
Plex Media Server Multiple Security Vulnerabilities
Plex Media Server is prone to the following security vulnerabilities:
1. A cross-site request-forgery vulnerability
2. A security-bypass vulnerability
3. Multiple information-disclosure vulnerabilities
An attacker can exploit these issues to steal cookie-based authentication credentials, to bypass certain security restrictions, to perform man-in-the-middle attacks or gain access to potentially sensitive information. Other attacks are also possible.
Plex Media Server 0.9.9.10 is vulnerable; other versions may also be vulnerable.
Plex Media Server is prone to the following security vulnerabilities:
1. A cross-site request-forgery vulnerability
2. A security-bypass vulnerability
3. Multiple information-disclosure vulnerabilities
An attacker can exploit these issues to steal cookie-based authentication credentials, to bypass certain security restrictions, to perform man-in-the-middle attacks or gain access to potentially sensitive information. Other attacks are also possible.
Plex Media Server 0.9.9.10 is vulnerable; other versions may also be vulnerable.
Exploit / POC
Plex Media Server Multiple Security Vulnerabilities
An attacker can exploit these issues through readily available tools and a browser.
An attacker can exploit these issues through readily available tools and a browser.
Solution / Fix
Plex Media Server Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Plex Media Server Multiple Security Vulnerabilities
References:
References:
- Plex Media Server HomePage (Plex )
- Plex Media Server Multiple Security Vulnerabilities (SEC Consult Vulnerability Lab)