Today > | 16 High | 14 Medium vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-49763

Dec. 2, 2024, 5:15 p.m.

Tags

security-advisories@github.com
CWE-942
2024-12-02
CVE-2024-49763

Product(s) Impacted

PlexRipper

  • 0.24.0

Description

PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0.

Weaknesses

CWE-942
Permissive Cross-domain Policy with Untrusted Domains

The product uses a cross-domain policy file that includes domains that should not be trusted.

CWE ID: 942

Date

Published: Dec. 2, 2024, 5:15 p.m.

Last Modified: Dec. 2, 2024, 5:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

References

https://github.com/ security-advisories@github.com
https://securitylab.github.com/ security-advisories@github.com