Skype Extras Manager (skypePM.exe) skype-plugin: URI Arbitrary XML File Deletion (uncredentialed check)

Medium Nessus Plugin ID 50597


The remote Skype client allows deletion of arbitrary XML files.


According to its timestamp, the version of Skype installed on the remote host likely includes a version of the Skype Extras Manager (skypePM.exe) that has a flaw in its handling of the 'skype-plugin:' protocol.

If an attacker can trick a user on the affected system into clicking on a specially crafted link, an arbitrary '.xml' file could be deleted on the affected system subject to the user's privileges.


Upgrade to Skype or later as that is reported to address the issue.

See Also

Plugin Details

Severity: Medium

ID: 50597

File Name: skype_4_2_0_169.nasl

Version: $Revision: 1.6 $

Type: remote

Agent: windows

Family: Windows

Published: 2010/11/15

Modified: 2016/11/17

Dependencies: 21208, 10785

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:U/RC:ND

Vulnerability Information

CPE: cpe:/a:skype:skype

Required KB Items: Services/skype

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2010/05/20

Vulnerability Publication Date: 2010/03/11

Reference Information

BID: 38667

OSVDB: 62913

Secunia: 38875