Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.
DISPUTED Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users.
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the getpassword.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.
DISPUTED Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers.
Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username that matches a valid password, as demonstrated using (a) SMTP and qmail, and (b) Courier IMAP and POP3.
End of life: 11/21/2023, Latest version: 18.0.55.2
End of life: 11/21/2023, Latest version: 18.0.55.2
End of life: 7/18/2023, Latest version: 18.0.52.3
End of life: 7/18/2023, Latest version: 18.0.52.3
End of life: 6/25/2024, Latest version: 18.0.60.1
End of life: 6/25/2024, Latest version: 18.0.60.1
End of life: 2/13/2024, Latest version: 18.0.57.5
End of life: 2/13/2024, Latest version: 18.0.57.5
End of life: 1/2/2024, Latest version: 18.0.56.4
End of life: 1/2/2024, Latest version: 18.0.56.4
End of life: 5/15/2024, Latest version: 18.0.59.2
End of life: 5/15/2024, Latest version: 18.0.59.2
End of life: 3/12/2023, Latest version: 18.0.49.2
End of life: 3/12/2023, Latest version: 18.0.49.2
End of life: 4/2/2024, Latest version: 18.0.58.2
End of life: 4/2/2024, Latest version: 18.0.58.2
End of life: 4/23/2023, Latest version: 18.0.50.2
End of life: 4/23/2023, Latest version: 18.0.50.2
End of life: 4/20/2021, Latest version: 17.8.11.95
End of life: 4/20/2021, Latest version: 17.8.11.95
End of life: 6/6/2023, Latest version: 18.0.51.1
End of life: 6/6/2023, Latest version: 18.0.51.1
End of life: 10/10/2023, Latest version: 18.0.54.4