CVE-2020-5742 Cross-site request forgery in Plex Media Server
Attackers can execute cross-origin requests against Plex Media Server due to improper access control, potentially bypassing security restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-5742?
CVE-2020-5742 is a high-severity vulnerability in Plex Media Server, published on 15 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.
Which versions are affected by CVE-2020-5742?
It affects 1 product.
Products include Plex Media Server.
How do I fix CVE-2020-5742?
No fix has been published for CVE-2020-5742 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-5742 being exploited?
There is no known exploitation of CVE-2020-5742 in the wild and no public exploit code.
Other vulnerabilities in Plex Media Server
- CVE-2026-96656 Plex Media Server External Control of File Name or Path
- CVE-2020-5741 Plex Media Server Remote Code Execution
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page
- CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)
Sources
Also known as GHSA-p5rm-fx86-wv2f.