CVE-2021-42835

{"id": "CVE-2021-42835", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2021-12-08T15:15:10.180", "references": [{"url": "https://bugsec.com/experts_teams/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://forums.plex.tv/t/security-regarding-cve-2021-42835/761510", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://ir-on.io/2021/12/02/local-privilege-plexcalation/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.plex.tv/media-server-downloads/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM)."}, {"lang": "es", "value": "Se ha detectado un problema en Plex Media Server versiones hasta 1.24.4.5081-e362dc1ee. Un atacante (con un punto de apoyo en un extremo por medio de una cuenta de usuario con pocos privilegios) puede acceder al servicio RPC expuesto del componente de servicio de actualizaci\u00f3n. Esta funcionalidad RPC permite al atacante interactuar con la funcionalidad RPC y ejecutar c\u00f3digo desde una ruta de su elecci\u00f3n (local, o remota por SMB) debido a una condici\u00f3n de carrera TOCTOU. Esta ejecuci\u00f3n de c\u00f3digo es producida en el contexto del servicio de actualizaci\u00f3n de Plex (que es ejecutado como SYSTEM)"}], "lastModified": "2021-12-13T17:14:44.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D655A8E-9991-48B9-950F-7DA9886B1227", "versionEndExcluding": "1.25.0.5282"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}