// For flags

CVE-2023-24044

 

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."

Un problema de inyección de encabezado de host en la página de inicio de sesión de Plesk Obsidian hasta 18.0.49 permite a los atacantes redirigir a los usuarios a sitios web maliciosos a través de un encabezado de solicitud de host. NOTA: la posición del proveedor es "la capacidad de utilizar nombres de dominio arbitrarios para acceder al panel es una característica prevista".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-21 CVE Reserved
  • 2023-01-22 CVE Published
  • 2024-06-21 First Exploit
  • 2024-08-02 CVE Updated
  • 2024-12-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Plesk
Search vendor "Plesk"
 Obsidian
Search vendor "Plesk" for product "Obsidian"
 <= 18.0.49
Search vendor "Plesk" for product "Obsidian" and version " <= 18.0.49"
-
Affected