CVE-2021-42835

An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee

published December 8, 2021

CVSS
—
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.6th percentile
Published
2021-12-08T14:34Z
EPSS history
Timeline
  • 08 DEC 14:34Z
    An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee
    cvelistv5