Lucene search

MitreCVE-2022-45130

HistoryNov 10, 2022 - 6:15 a.m.

CVE-2022-45130

2022-11-1006:15:13

CWE-352

mitre

web.nvd.nist.gov

plesk

obsidian

csrf

vulnerability

admin password

nvd

cve-2022-45130

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

35.2%

JSON

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names (“Obsidian”), not numbers.

Affected configurations

Nvd

Node

pleskobsidianMatch-

VendorProductVersionCPE
pleskobsidian-cpe:2.3:a:plesk:obsidian:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
plesk	obsidian	-	cpe:2.3:a:plesk:obsidian:-:::::::*

References

fortbridge.co.uk/research/compromising-plesk-via-its-rest-api/

Social References

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

35.2%

JSON

Related for CVE-2022-45130