Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.

According to its self-reported version number, the version of Plex Media Server installed on the remote Windows host is prior to 1.18.2. It is, therefore, affected by a local privilege escalation vulnerability. The vulnerability exists in the Plex Update Service due to exposed functionality over an ALPC port. An unauthenticated, local attacker can exploit this, via the ALPC port, to execute arbitrary commands with SYSTEM privileges.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2020-5740

high

Tenable Plugins

high