CVE-2019-19141: Path Traversal
The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorizedkeys file there, and logging into the host as the Plex user via SSH.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-19141?
CVE-2019-19141 is a vulnerability in Plex Media Server that allows remote authenticated users to write files anywhere with permissions, leading to potential remote code execution.
What is the severity of CVE-2019-19141?
CVE-2019-19141 has a severity score of 8.8, which is considered high.
How does CVE-2019-19141 affect Plex Media Server?
CVE-2019-19141 affects Plex Media Server versions up to 1.18.2.2029 and allows remote authenticated users to write files anywhere with permissions.
How can I fix CVE-2019-19141 in Plex Media Server?
To fix CVE-2019-19141, users should update Plex Media Server to a version beyond 1.18.2.2029.
Where can I find more information about CVE-2019-19141?
More information about CVE-2019-19141 can be found at this link: https://forums.plex.tv/t/security-camera-upload/507289