# Vulnerability **URL:** \ **Category:** Plex Media Server\ **Tags:** server-windows\ **Created:** [December 7, 2021, 9:17pm UTC](https://forums.plex.tv/t/vulnerability/762913 "2021-12-07T21:17:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![plex\_jfr.im](https://avatars.discourse-cdn.com/v4/letter/p/e274bd/32.png) [@plex\_jfr.im](https://forums.plex.tv/u/plex_jfr.im)\ **Post date:** [December 7, 2021, 9:17pm UTC](https://forums.plex.tv/t/vulnerability/762913/1 "2021-12-07T21:17:02Z")
> [@Security: Regarding CVE-2021-42835](https://forums.plex.tv/t/security-regarding-cve-2021-42835/761510): > > Hello, We have recently been made aware of a security vulnerability in Plex Media Server versions prior to 1.25.0 that could allow a local Windows user to obtain administrator privileges without authorization. To be clear, this required the user to already have local, physical access to the computer (just with a different user account on Windows). There are no indications that this exploit could be used from a remote machine. This issue has been assigned [CVE-2021-42835](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42835). Plex Media Server vers… That’s not a disclosure. That’s a non-info. All you say is the same thing the changelog said and neither of them have any useful info for an administrator to see if they might have been attacked in the past, nor to see if your fix missed something since we both know Plex never fixes anything. Who reported the vulnerability, and when will further details be disclosed? ---
**Author:** ![dane22](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/dane22/32/4389_2.png) [@dane22](https://forums.plex.tv/u/dane22)\ **Post date:** [December 7, 2021, 9:22pm UTC](https://forums.plex.tv/t/vulnerability/762913/2 "2021-12-07T21:22:40Z")
Not Plex, but common practice is to await until people had a fair chance to upgrade, before providing more details! ---
**Author:** ![plex\_jfr.im](https://avatars.discourse-cdn.com/v4/letter/p/e274bd/32.png) [@plex\_jfr.im](https://forums.plex.tv/u/plex_jfr.im)\ **Post date:** [December 10, 2021, 7:21pm UTC](https://forums.plex.tv/t/vulnerability/762913/3 "2021-12-10T19:21:22Z")
No, actually, common practice is to not provide _any_ details until people have had a chance to upgrade. Common practice is also to list the embargo date on announcements so that people know in advance when details will be released. Common practice is _ **not** _ to pretend that a one-line changelog entry is a vuln disclosure. PS people have had over a week to upgrade. It’s spelled “wait”, by the way. ---
**Author:** ![system](https://global.discourse-cdn.com/plex/original/3X/2/a/2acb9765406f63293d357b4ec509ec39aa28f2ad.png) [@system](https://forums.plex.tv/u/system)\ **Post date:** [March 10, 2022, 7:21pm UTC](https://forums.plex.tv/t/vulnerability/762913/4 "2022-03-10T19:21:46Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.