CVE-2024-49763 PlexRipper allows API leak due to open CORS policy
Attackers can steal Plex login credentials via an open CORS policy by tricking users into visiting a malicious site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-49763?
CVE-2024-49763 is a high-severity vulnerability in PlexRipper, published on 2 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0.
Weakness: CWE-942
Which versions are affected by CVE-2024-49763?
How do I fix CVE-2024-49763?
No fix has been published for CVE-2024-49763 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-49763 being exploited?
There is no known exploitation of CVE-2024-49763 in the wild and no public exploit code.