| Package | Affected versions | Patched versions |
|---|---|---|
| obsidian | ≤ 18.0.49 |
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free