CVE-2020-5741 - Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code

HIGH KEV

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code

Published May 8, 2020 ·Due Mar 31, 2023

7.2

HIGH

CVSS 3.1

EPSS 72.94%

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Plex Media Server (Windows)

n/a

Version	Status	Constraints
Versions prior to 1.19.3	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

Link	Providers	Tags
http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26900		Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5741		government-resourceUS Government Resource
https://www.tenable.com/security/research/tra-2020-32		x_refsource_MISCExploitThird Party Advisory