• 0 Posts
  • 6 Comments
Joined 2 years ago
cake
Cake day: August 16th, 2023

help-circle

  • thax@lemmy.dbzer0.comtoTechnology@lemmy.worldPlex got hacked.
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    edit-2
    2 hours ago

    It matters if someone manages to hide an exploit in jellyfin’s codebase, or more likely, a popular plugin. I imagine many folk have permissive outgoing firewall rules, in which case, an exploit could establish connectivity. Whether that eventually leads to privilege escalation on the jellyfin host would depend upon other variables.

    edit: I should add that I’ve not used jellyfin and am unfamiliar with how plugins are implemented. I don’t want to speak out of turn, only to suggest, in the abstract, that just because software isn’t exposed to the net, doesn’t mean it cannot harbor exploits that could become problematic. Plugins just seem to be a common vector for such types of software.