CVE-2024-49763CWE-942

PlexRipper allows API leak due to open CORS policy

High · published December 2, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2024-12-02T16:41Z
EPSS history
Timeline
  • 02 DEC 16:41Z
    PlexRipper allows API leak due to open CORS policy
    cvelistv5