Uncontrolled search path element vulnerability in Plesk

Posted date
3 - Media
Affected Resources
  • Plesk Installer, version.

INCIBE has coordinated the publication of one vulnerabilitiy that affects Plesk Installer version, a server management platform, which has been discovered by Alexander Huaman Jaimes.

This vulnerabilitiy has been assigned the following code, CVSS v3.1 base score, CVSS vector string, and CWE vulnerability type:

  • CVE-2023-4931: CVSS v3.1: 6.3 | CVSS: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L | CWE-427.

The vulnerability has been fixed in Plesk Installer 3.55.0.

  • CVE-2023-4931: uncontrolled search path element vulnerability in Plesk Installer affects version A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.

botón arriba