• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Question Will there be an update soon? Vulnerability-all versions prior to phpMyAdmin 4.9.0

GerdSchrewe

Basic Pleskian
Plesk 17.8.11 Update 55 - Ubuntu 18.04
current version is phpmyadmin 4.8.4-ubuntu18.04.build1708181212.18

Security - PMASA-2019-3

Date: 2019-05-06

Summary
SQL injection in Designer feature

Description
A vulnerability
was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.

Severity

We consider this vulnerability to be serious

Affected Versions
phpMyAdmin versions prior to 4.8.6 are affected.

Solution
Upgrade to phpMyAdmin 4.8.6 or newer or apply patch listed below.


Security - PMASA-2019-4
Date: 2019-06-04

Description

A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.

Severity
We consider this vulnerability to be severe.

Mitigation factor
Only the 'cookie' auth_type is affected; users can temporary use phpMyAdmin's http authentication as a workaround.

Affected Versions
All versions prior to phpMyAdmin 4.9.0 are affected, probably at least as old as version 4.0 (perhaps even earlier)

Solution
Upgrade to phpMyAdmin 4.9.0 or newer or apply patch listed below.
Security - PMASA-2019-4
 
Last edited:
Developers are working on it and updated/patched version will be released soon.
 
Back
Top