The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.
References
Link | Resource |
---|---|
https://support.plesk.com/hc/en-us/articles/4402990507026 | Vendor Advisory |
https://tarekbouali.com/cves/cve-2021-35976 | Exploit Third Party Advisory |
https://www.bouali.io/cves/cve-2021-35976 | Broken Link |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2021-09-10T11:08:18
Updated: 2021-11-04T00:40:30
Reserved: 2021-06-30T00:00:00
Link: CVE-2021-35976
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-09-10T12:15:13.193
Modified: 2021-11-28T23:18:47.377
Link: CVE-2021-35976
JSON object: View
Redhat Information
No data.
CWE