• Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
    To get into the festive spirit, install the Skins extension.
  • The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
  • The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.

System password is shown as clear text

A

Anassa

Guest
Hi,
I figured out that the plesk admin password is shown as clear text after upgrading to Plesk 8.1. I am able to retrieve password for some other servers running Plesk 8.1 easly.
I am happy to share this information with SWSOFT in more details. The phone operators are not keen to understand this security issue; they are more interested in the number of my service contract I obviously do not have :-((
Kind regards,
Lars
 
hmm....

Hi,

hm can you please provide me with more details so I can check this on our systems? It would be grade because if this is true, we must have a patch ASAP!!! There was an securtiy Problem like this in Plesk 8.x for Windows which had be closed after some time after this occurs. Hope you can tell us what you had done so we can check if this occurs on every system.

Best regards,

dkuwi
 
swsoft doesn't officially read here, try to sell the vulnerability on ebay ;)
 
Originally posted by Anassa
Hi,
I figured out that the plesk admin password is shown as clear text after upgrading to Plesk 8.1. I am able to retrieve password for some other servers running Plesk 8.1 easly.
Click to expand...

shocked - but agree here on my system!!
 
how did you do

Hello,

hm I am also shocked but I dont know how you find it out, could you please tell it to me so I can try it on my systems here?

Best regards,

dkuwi
 
You should restart your server (not only apache) and change your system password. I furthermore recommend, that you should not publish phpinfo infomation publicly.
Rgds,
anassa
 
Is it possible to get some more details on this? I would like to check this with my server as well. :(
 
just make an update and change your password. then you are fine.

I will not reveal any sec. related hints.
 
Well, this is the admin passwoord for ~12 server holding a few hundred customers.
You can't change this just on a guess as the change has a big rat-tail of changes as well. :(
 
You must log in or register to reply here.

Similar threads

T
Issue Joomla Toolkit - Not all instances shown
Replies
7
Views
3K
Sebahat.hadzhi
Sebahat.hadzhi
Azurel
Resolved ModSecurity shown as "On" in Plesk GUI but runtime is "Disabled" and modsec_audit.log stays empty
Replies
2
Views
2K
Azurel
Azurel
K
Question Correct way to run Nextcloud occ?
Replies
3
Views
2K
kimharding
K
brother4
Question Automatically retrieve and download Plesk backups from /var/lib/psa/dumps/
Replies
3
Views
4K
brother4
brother4
K
Forwarded to devs Error message for additional nginx directives are causing confusion when proxy mode is enabled
Replies
1
Views
4K
Sebahat.hadzhi
Sebahat.hadzhi
Back
Top