title: Uncontrolled search path element vulnerability in Plesk
description: Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
problem types: CWE-427 Uncontrolled Search Path Element
affected:
{
defaultStatus: unaffected
product: Plesk Installer
vendor: Plesk
versions:
status: affected, version: 3.27.0.0
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: The vulnerability has been fixed in Plesk Installer 3.55.0.