PT-2025-27799 · Plesk · Plesk Obsidian

CVE-2025-49618 · Publicado 2025-07-03 · Atualizado 2025-07-03

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.69

Description: The issue allows unauthenticated requests to the "/login up.php" API endpoint to reveal sensitive AWS credentials, including accessKeyId, secretAccessKey, region, and endpoint.

Recommendations: For Plesk Obsidian version 18.0.69, restrict access to the "/login up.php" API endpoint to prevent unauthorized disclosure of AWS credentials until a fix is available.

Correção

Enumeração de Fraquezas

CWE-402

Identificadores relacionados

CVE-2025-49618

Produtos afetados

Plesk Obsidian

Referências · 7

• https://twitter.com/VulmonFeeds/status/1940837203489231034 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-49618 · Nota de Segurança
• https://twitter.com/ZeroDayCVE/status/1940767873473077462 · Publicação no Twitter
• https://plesk.com/blog/plesk-news-announcements/plesk-obsidian-18-0-69-is-here · Nota
• https://twitter.com/VolerionSec/status/1940762901679153607 · Publicação no Twitter
• https://linkedin.com/posts/gaetano-cesano-976420200_qualche-giorno-fa-stavo-testando-plesk-obsidian-activity-7341794923198709761-by9G · Nota
• https://twitter.com/CVEnew/status/1940759684165566715 · Publicação no Twitter