Uncontrolled search path element vulnerability in Plesk

Posted date
27/11/2023
Importance
3 - Media
Affected Resources
  • Plesk Installer, 3.27.0.0 version.
Description

INCIBE has coordinated the publication of one vulnerabilitiy that affects Plesk Installer 3.27.0.0 version, a server management platform, which has been discovered by Alexander Huaman Jaimes.

This vulnerabilitiy has been assigned the following code, CVSS v3.1 base score, CVSS vector string, and CWE vulnerability type:

  • CVE-2023-4931: CVSS v3.1: 6.3 | CVSS: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L | CWE-427.
Solution

The vulnerability has been fixed in Plesk Installer 3.55.0.

Detail
  • CVE-2023-4931: uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.

botón arriba