Back

CVE-2018-13415

CRITICAL

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

Published: Aug 13, 2018 Modified: Jun 17, 2026
CWE-611

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor Product Version
plex media_server 1.13.2.5154

GitHub Security Advisory GHSA-98rp-qwvr-j7cp

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is...

References (4)

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 31.81%

Top 2% most likely to be exploited

Threat Score 48.7 / 100

Data Sources

NVD EPSS GitHub