kb: security
Situation
A blind SQL injection vulnerability was discovered in Plesk.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| Plesk for Linux | 18.0.51 - 18.0.79.4 18.0.80 |
18.0.79.5 18.0.80.1 |
| Plesk for Windows | 18.0.79.4 and earlier 18.0.80 |
18.0.79.5 18.0.80.1 |
How to verify that a server is patched
You can confirm your installed Plesk version and build using the Plesk interface:
- Log in to Plesk.
- In the left sidebar, go to Tools & Settings.
- Under Plesk, click About Plesk.
-
The currently installed Plesk version is displayed under the logo (for example, "Version 18.0.80 Update #1").
- Compare the displayed build to the patched version in the table above. If an earlier version is shown, the server should be updated.
Impact
An attacker could extract data from the server's database with a read-only SQL injection.
Call to action
Update Plesk to the latest build: How to update Plesk Obsidian to the latest build
Acknowledgement
We would like to thank Aziz Knani for responsibly disclosing this vulnerability.
Comments
Hi! Could you please clarify whether exploitation of this vulnerability requires an authenticated reseller account, or whether users with lower privileges (e.g. customer accounts) could also exploit it?
The mitigation section seems to imply that reseller-level access is required, but this is not explicitly stated in the advisory.
We would also like to know the answer to Amalfiweb 's question!
Websavers Inc Amalfiweb The security team specified resellers in the mitigation, so it's for resellers, but to fully address this Plesk should be updated.
Hello, I cannot login to my Plesk account due to this issue.
DAVID WHITE This shouldn't cause any issues with login. Please open a ticket with us if you need assistance with logging in.
I did open a ticket at approx. 15:00 EST but it is not showing up in ‘My Request’
Websavers Inc Amalfiweb The security team sent us an update clarifying that it is not specific to reseller accounts. Plesk should be updated to address this issue.
Please sign in to leave a comment.