Vulnerability Intelligence Report
CVE-2019-19141
The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
EPSS Probability:4.35%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| plex | media_server | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.353%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2019-11-20T00:00:00 |
| Published | 2019-12-19T22:28:46 |
| Last Updated | 2024-08-05T02:09:39 |
Community Chatter & Buzz