CVE-2019-19141

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://forums.plex.tv/t/security-camera-upload/507289	Vendor Advisory
https://forums.plex.tv/t/security-camera-upload/507289	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:34

Type	Values Removed	Values Added
References	~~() https://forums.plex.tv/t/security-camera-upload/507289 - Vendor Advisory~~	() https://forums.plex.tv/t/security-camera-upload/507289 - Vendor Advisory

Information

Published : 2019-12-19 23:15

Updated : 2024-11-21 04:34

NVD link : CVE-2019-19141

Mitre link : CVE-2019-19141

CVE.ORG link : CVE-2019-19141

JSON object : View

Products Affected

plex

media_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2019-19141", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-12-19T23:15:16.040", "references": [{"url": "https://forums.plex.tv/t/security-camera-upload/507289", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://forums.plex.tv/t/security-camera-upload/507289", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH."}, {"lang": "es", "value": "La funcionalidad Camera Upload en Plex Media Server versiones hasta 1.18.2.2029, permite a usuarios autenticados remotos escribir archivos en cualquier lugar donde la cuenta de usuario que ejecuta Plex Media Server tenga permisos. Esto permite una ejecuci\u00f3n de c\u00f3digo remota por medio de una variedad de m\u00e9todos, tal y como (en una instalaci\u00f3n predeterminada de Ubuntu) crear una carpeta .ssh en el directorio de inicio del usuario de plex mediante el salto de directorio, cargando un archivo authorized_keys de SSH all\u00ed e iniciar sesi\u00f3n en el host como el usuario de Plex por medio de SSH."}], "lastModified": "2024-11-21T04:34:15.283", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30A560EC-669B-4101-B413-00726CE50A1B", "versionEndIncluding": "1.18.2.2029"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}