PT-2025-27799 · Plesk · Plesk Obsidian

Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-49618

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.69

Description: The issue allows unauthenticated requests to the "/login up.php" API endpoint to reveal sensitive AWS credentials, including accessKeyId, secretAccessKey, region, and endpoint.

Recommendations: For Plesk Obsidian version 18.0.69, restrict access to the "/login up.php" API endpoint to prevent unauthorized disclosure of AWS credentials until a fix is available.

Fix

Weakness Enumeration

CWE-402

Related Identifiers

CVE-2025-49618

Affected Products

Plesk Obsidian

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-49618 · Security Note
• https://twitter.com/VulmonFeeds/status/1940837203489231034 · Twitter Post
• https://twitter.com/ZeroDayCVE/status/1940767873473077462 · Twitter Post
• https://plesk.com/blog/plesk-news-announcements/plesk-obsidian-18-0-69-is-here · Note
• https://twitter.com/VolerionSec/status/1940762901679153607 · Twitter Post
• https://linkedin.com/posts/gaetano-cesano-976420200_qualche-giorno-fa-stavo-testando-plesk-obsidian-activity-7341794923198709761-by9G · Note
• https://twitter.com/CVEnew/status/1940759684165566715 · Twitter Post