Description (CNA)
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://github.com/Jainil-89/CVE-2025-65518/blob/main/cve.md
- https://docs.plesk.com/release-notes/obsidian/change-log/
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Plesk Obsidian. A remote attacker, without needing to authenticate, can send a specially crafted request to the get_password.php endpoint. This malicious request causes the web interface to continuously reload, leading to a Denial of Service (DoS) condition. This renders the service unavailable to legitimate users, impacting the availability of the Plesk Obsidian instance.