CVE-2024-49763

PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/PlexRipper/PlexRipper/commit/184074644a1f5a8ac59519929a9c4b92280fb2a1
https://securitylab.github.com/advisories/GHSL-2024-305_PlexRipper/

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) PlexRipper es un descargador de contenido multimedia multiplataforma para Plex. La política CORS abierta de PlexRipper permite a los atacantes obtener información confidencial de PlexRipper al hacer que el usuario acceda al dominio del atacante. Esto permite que un sitio web atacante acceda al endpoint /api/PlexAccount y robe el inicio de sesión de Plex del usuario. Esta vulnerabilidad se corrigió en la versión 0.24.0.

02 Dec 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-02 17:15

Updated : 2026-06-17 08:00

NVD link : CVE-2024-49763

Mitre link : CVE-2024-49763

CVE.ORG link : CVE-2024-49763

JSON object : View

Products Affected

No product.

CWE

CWE-942

Permissive Cross-domain Policy with Untrusted Domains

{"id": "CVE-2024-49763", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-49763", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-02T17:21:00.347159Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "PlexRipper", "product": "PlexRipper", "versions": [{"status": "affected", "version": "< 0.24.0"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:plexripper_project:plexripper:*:*:*:*:*:*:*:*"], "vendor": "plexripper_project", "product": "plexripper", "versions": [{"status": "affected", "version": "0", "lessThan": "0.24.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2024-12-02T17:15:11.830", "references": [{"url": "https://github.com/PlexRipper/PlexRipper/commit/184074644a1f5a8ac59519929a9c4b92280fb2a1", "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2024-305_PlexRipper/", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "PlexRipper is a cross-platform media downloader for Plex. PlexRipper\u2019s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker\u2019s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user\u2019s Plex login. This vulnerability is fixed in 0.24.0."}, {"lang": "es", "value": " PlexRipper es un descargador de contenido multimedia multiplataforma para Plex. La pol\u00edtica CORS abierta de PlexRipper permite a los atacantes obtener informaci\u00f3n confidencial de PlexRipper al hacer que el usuario acceda al dominio del atacante. Esto permite que un sitio web atacante acceda al endpoint /api/PlexAccount y robe el inicio de sesi\u00f3n de Plex del usuario. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.24.0."}], "lastModified": "2026-06-17T08:00:24.177", "sourceIdentifier": "security-advisories@github.com"}