CVE-2025-54336 in Obsidian

Riassunto

di MITRE • 19/08/2025

In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsabile: MITRE
• Prenotare: 20/07/2025
• Divulgazione: 19/08/2025
• Moderazione: accettato
• Voce: VDB-320554
• CPE: pronto
• CWE: CWE-697 (confermato)
• CVSS: 5.6 (VulDB)
• EPSS: 0.00510
• KEV: no
• Attività: molto basso
• Settore: Telecommunication

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-54336
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-54336
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-54336/