Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused.

TLP: RED Not for disclosure, restricted to participants only. Patches for CVE-2020-5741 and CVE-2021-39144 are available.įortiGuard Labs has the following IPS protection in place for CVE-2020-5741 and CVE-2021-39144: Have the Vendors Released a Patch for CVE-2020-5741 and CVE-2021-39144?

A remote attacker could exploit this to execute arbitrary code within the context of the application, via uploading a crafted XML file. The vulnerability is due to insufficient sanitizing of user supplied inputs in the application.

Successful exploitation allows a remote attacker to execute arbitrary Python code within the context of the application.ĬVE-2021-39144 is an Insecure Deserialization vulnerability that affects VMware library XStream version 1.4.17 and prior. As such, patches should be applied to both vulnerabilities as soon as possible.ĬVE-2020-5741 is a Remote Code Execution (RCE) vulnerability that affects Plex Media Server version 1.19.2 and prior. This is significant because CVE-2020-5741 (Plex Media Server Remote Code Execution Vulnerability) and CVE-2021-39144 (XStream Remote Code Execution Vulnerability) on the CISA's Known Exploited Vulnerabilities Catalog were observed to be actively exploited in the wild. The catalog lists vulnerabilities that are being actively exploited in the wild and require federal agencies to apply patches by the due date. FortiGuard Labs is aware that the Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2020-5741 (Plex Media Server remote code execution vulnerability) and CVE-2021-39144 (XStream Remote Code Execution Vulnerability) to their Known Exploited Vulnerabilities (KEV) catalog on March 10, 2023.

Fortiguard