Headline
CVE-2023-4931: Uncontrolled search path element vulnerability in Plesk
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
Affected Resources
- Plesk Installer, 3.27.0.0 version.
Description
INCIBE has coordinated the publication of one vulnerabilitiy that affects Plesk Installer 3.27.0.0 version, a server management platform, which has been discovered by Alexander Huaman Jaimes.
This vulnerabilitiy has been assigned the following code, CVSS v3.1 base score, CVSS vector string, and CWE vulnerability type:
- CVE-2023-4931: CVSS v3.1: 6.3 | CVSS: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L | CWE-427.
Solution
The vulnerability has been fixed in Plesk Installer 3.55.0.
Detail
- CVE-2023-4931: uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.