CVE-2021-35976: XSS

Q: What is CVE-2021-35976?

CVE-2021-35976 is a vulnerability that allows for reflected XSS attacks in the website preview feature of Plesk Obsidian on Linux.

Q: What is the severity of CVE-2021-35976?

CVE-2021-35976 has a severity rating of 6.1, classified as medium.

Q: How does CVE-2021-35976 affect Plesk Obsidian?

CVE-2021-35976 affects Plesk Obsidian versions 18.0.0 through 18.0.32 on Linux.

Q: What can an attacker do with CVE-2021-35976?

An attacker can execute malicious JavaScript code in the victim's browser by using the link to preview sites hosted on the server.

Q: Are there any recommended fixes for CVE-2021-35976?

To mitigate CVE-2021-35976, it is recommended to update Plesk Obsidian to a version beyond 18.0.32.

Published Sep 10, 2021

Updated

The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.

Affected Software

1 affected component

Plesk Obsidian>=18.0.0<=18.0.32

Event History

Sep 10, 2021

CVE Published

via MITRE·11:08 AM

Data Sourced

via MITRE·11:08 AM

Description

Frequently Asked Questions

What is CVE-2021-35976?

CVE-2021-35976 is a vulnerability that allows for reflected XSS attacks in the website preview feature of Plesk Obsidian on Linux.

What is the severity of CVE-2021-35976?

CVE-2021-35976 has a severity rating of 6.1, classified as medium.

How does CVE-2021-35976 affect Plesk Obsidian?

CVE-2021-35976 affects Plesk Obsidian versions 18.0.0 through 18.0.32 on Linux.

What can an attacker do with CVE-2021-35976?

An attacker can execute malicious JavaScript code in the victim's browser by using the link to preview sites hosted on the server.

Are there any recommended fixes for CVE-2021-35976?