Vulnerability · Published Dec 2, 2024 · Assigned by GitHub_M
CVE-2024-49763PlexRipper allows API leak due to open CORS policy
High 8.7
In plain English
A high-severity security flaw in PlexRipper from PlexRipper. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PlexRipper | PlexRipper | < 0.24.0 |
Weakness: CWE-942 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N