← Vulnerability feed

Vulnerability record · CVE-2018-13415 · published 13 August 2018

CVE-2018-13415: Plex media server xml external entity (xxe) vulnerability

Plex · Media Server

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

9.8 CVSS 3.0 Critical EPSS 31% · top 1.7% CWE-611 · XML external entity (XXE)
9.8CVSS 3.0 base score, v2 7.5
31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://seclists.org/fulldisclosure/2018/Aug/1 ExploitMailing ListTechnical DescriptionThird Party Advisory
https://www.exploit-db.com/exploits/45146/ ExploitTechnical DescriptionThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Aug/1 ExploitMailing ListTechnical DescriptionThird Party Advisory
https://www.exploit-db.com/exploits/45146/ ExploitTechnical DescriptionThird Party AdvisoryVDB Entry

Track CVE-2018-13415 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-96656Plex media server vulnerabilityPlex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Option…KEVEPSS 1.8%7.2CVE-2020-5741Plex Media Server Windows deserialization leads to Python code executionPlex Media Server on Windows deserializes untrusted data, allowing a remote, authenticated attacker to execute arbitrary Python code. The flaw is a C…KEVEPSS 73%analysed6.9CVE-2026-96654Plex media server vulnerabilityPlex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' f…KEVEPSS 1.9%5.3CVE-2026-96655Plex media server server-side request forgery (ssrf) vulnerabilityPlex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/un…KEVEPSS 11%5.3CVE-2026-96652Plex media server server-side request forgery (ssrf) vulnerabilityPlex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'pro…KEVEPSS 12%8.8CVE-2020-5742Plex media server vulnerabilityImproper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.EPSS 1.5%8.8CVE-2019-19141Plex media server path traversal vulnerabilityThe Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account r…EPSS 4.7%7.8CVE-2020-5740Plex media server uncontrolled search path element vulnerabilityImproper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privi…EPSS 0.75%

Source: NIST National Vulnerability Database (record CVE-2018-13415), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.