CVE-2023-4931

Published Nov 27, 2023

Last updated a year ago

Overview

Description: Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
Source: cve-coordination@incibe.es
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve-coordination@incibe.es: CWE-427

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:plesk:plesk:3.27.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0B7A8C4A-1E99-4658-B715-BC195CF55400"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References