Skype Extras Manager (skypePM.exe) skype-plugin: URI Arbitrary XML File Deletion (credentialed check)

Medium Nessus Plugin ID 50598


The remote Skype client allows deletion of arbitrary XML files.


According to its timestamp, the version of Skype installed on the remote host likely includes a version of the Skype Extras Manager (skypePM.exe) that has a flaw in its handling of the 'skype-plugin:' protocol.

If an attacker can trick a user on the affected system into clicking on a specially crafted link, arbitrary '.xml' files on the affected system could be deleted, subject to the user's privileges.


Upgrade to Skype or later as that is reported to address the issue.

See Also

Plugin Details

Severity: Medium

ID: 50598

File Name: skype_4_2_0_169_creds.nasl

Version: $Revision: 1.7 $

Type: local

Agent: windows

Family: Windows

Published: 2010/11/15

Modified: 2016/11/17

Dependencies: 13855

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:U/RC:ND

Vulnerability Information

CPE: cpe:/a:skype:skype

Required KB Items: SMB/Registry/Enumerated

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2010/05/20

Vulnerability Publication Date: 2010/03/11

Reference Information

BID: 38667

OSVDB: 62913

Secunia: 38875