Actively exploited · Published May 8, 2020 · Assigned by tenable
CVE-2020-5741
High 7.2 Exploited
In plain English
A high-severity unsafe deserialization in Plex Media Server (Windows). Attackers are actively exploiting it in the wild (listed by CISA on March 10, 2023). The chance it is exploited in the next 30 days is estimated at 72.9% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 31, 2023.
Official description
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Plex Media Server (Windows) | Versions prior to 1.19.3 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H