VULNERABILITY INTELLIGENCE

CVE-2023-4931

CVSS score6.3 MEDIUM

EPSS probability0.25%

CISA KEVNot currently listed

Published2023-11-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Description

Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.

Weakness classification

CWE-427: Uncontrolled Search Path Element

Primary references

cve-coordination@incibe.es — Vendor Advisory
cve-coordination@incibe.es — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory