Description
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Plesk | Obsidian | 18.0.69 | — |
Medium · 5.8
CVE-2025-49618
EUVD-2025-19875GHSA-3q75-rp5f-jff5
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
Published Jul 3, 2025 · Updated Jul 3, 2025 · Assigned by mitre