Plesk Onyx update for PHP
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2015-8866 |
| CWE-ID | CWE-79 CWE-835 CWE-611 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Plesk Web applications / Remote management & hosting panels |
| Vendor | Parallels |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Corss-site scrpting
EUVDB-ID: #VU9869
Risk: Low
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to improper input validation in .phar when processing 404 response. A remote attacker can create a specially crafted link, rick tyhe victim into opening it and execute arbitrary HTML and script code in victim's browser in context of vulnerable website.
Update to version 17.0.17 Update 45 or 17.5.3 Update 37.
Vulnerable software versionsPlesk: 17.0.17 Update 43 - 17.5.3 Update 36
External linkshttp://docs.plesk.com/release-notes/onyx/change-log/#contents-1753-mu37
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Denial of service
EUVDB-ID: #VU9868
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to an error in gdImageCreateFromGifCtx() function when processing images with GD library. A remote attacker can create a specially crafted image, pass it to vulnerable application and perform a denial of service (DoS) attack via infinite loop.
Update to version 17.0.17 Update 45 or 17.5.3 Update 37.
Vulnerable software versionsPlesk: 17.0.17 Update 43 - 17.5.3 Update 36
External linkshttp://docs.plesk.com/release-notes/onyx/change-log/#contents-1753-mu37
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper restriction of XML external entity reference (XXE)
EUVDB-ID: #VU9867
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2015-8866
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform XXE. attcks.
The vulnerability exists in ext/libxml/libxml.c when using PHP-FPM due to improper isolation of each threat from libxml_disable_entity_loader changes in other threads. A remote attacker can perform XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.
Note: this vulnerability is known at least since 2013 and it was patched several times.
Update to version 17.0.17 Update 45 or 17.5.3 Update 37.
Vulnerable software versionsPlesk: 17.0.17 Update 43 - 17.5.3 Update 36
External linkshttp://docs.plesk.com/release-notes/onyx/change-log/#contents-1753-mu37
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
