CVE-2023-4931: Uncontrolled search path element vulnerability in Plesk
First published: Mon Nov 27 2023(Updated: )
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
Credit: cve-coordination@incibe.es
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Plesk Obsidian | =3.27.0.0 |
Remedy
The vulnerability has been fixed in Plesk Installer 3.55.0.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the uncontrolled search path element vulnerability in Plesk?
The vulnerability ID for the uncontrolled search path element vulnerability in Plesk is CVE-2023-4931.
What is the severity of CVE-2023-4931?
The severity of CVE-2023-4931 is high, with a severity value of 7.8.
How does the uncontrolled search path element vulnerability in Plesk affect the software?
The uncontrolled search path element vulnerability in Plesk affects version 3.27.0.0.
How can a local attacker exploit CVE-2023-4931?
A local attacker could execute arbitrary code by injecting DLL files into the same folder where the Plesk Installer is installed, resulting in DLL hijacking.
How can I fix the uncontrolled search path element vulnerability in Plesk?
To fix the uncontrolled search path element vulnerability in Plesk, update to a version that is not affected by the vulnerability.
- agent/references
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/plesk
- canonical/plesk obsidian
- version/plesk obsidian/3.27.0.0