CVE-2014-9304

High

Published: 07/12/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Plex Media Server before version 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to internal resources, potentially leading to serious security breaches within the organization.

Recommendation

It is recommended to update Plex Media Server to version 0.9.9.3 or later to mitigate this vulnerability and review the server's security configuration.

Other vulnerabilities in Plex Media Server

CVE-2020-5741HighActively exploited
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Original NVD description (English source)

Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server.