CVE-2022-45130: CSRF
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-45130?
CVE-2022-45130 is a vulnerability in Plesk Obsidian that allows a CSRF attack via the /api/v2/cli/commands REST API to change an Admin password.
How does the CSRF attack in CVE-2022-45130 work?
The CSRF attack in CVE-2022-45130 exploits the lack of cross-site request forgery protection in Plesk Obsidian's /api/v2/cli/commands REST API, allowing an attacker to change an Admin password without proper authorization.
What is the severity of CVE-2022-45130?
CVE-2022-45130 has a severity rating of medium (6.5) due to the potential impact of a successful CSRF attack on changing an Admin password.
Is Plesk Obsidian the only affected version?
Yes, Plesk Obsidian is the specific version affected by CVE-2022-45130.
How can I mitigate the vulnerability in CVE-2022-45130?
To mitigate the vulnerability in CVE-2022-45130, it is recommended to apply the relevant security patches provided by Plesk and follow the best practices for securing your Plesk Obsidian installation.