Skip to content

Register now for our Web Enablement Ecosystem webinar!

  • Contact us: +34 944 58 06 58
  • Plesk Partner Program
  • Plesk Lifecycle Policy
  • Blog
  • Contact us
  • Plesk 360
  • Contact us: +34 944 58 06 58
  • Plesk Partner Program
  • Plesk Lifecycle Policy
  • Blog
  • Contact us
  • Plesk 360
  • Solutions
    By Role
    • Developers
    • Content Managers
    • Digital Agencies
    • IT Admins
    • Web Hosters
    • Hyperscalers
    • Developers
    • Content Managers
    • Digital Agencies
    • IT Admins
    • Web Hosters
    • Hyperscalers
    By Edition
    • Web Admin Edition
    • Web Pro Edition
    • Web Host Edition
    • Business & Collaboration
    • Plesk WP Edition
    • Web Admin Edition
    • Web Pro Edition
    • Web Host Edition
    • Business & Collaboration
    • Plesk WP Edition
    By Cloud
    • Amazon Web Services
    • Microsoft Azure
    • Alibaba Cloud
    • GCP Marketplace
    • Vultr
    • DigitalOcean
    • Linode
    • UpCloud
    • Amazon Web Services
    • Microsoft Azure
    • Alibaba Cloud
    • GCP Marketplace
    • Vultr
    • DigitalOcean
    • Linode
    • UpCloud
    Partner Program
    Exclusive discounts, benefits and exposure to take your business to the next level
    Become a partner
    • By Role
      • Developers
      • Content Managers
      • Digital Agencies
      • IT Admins
      • Web Hosters
      • Hyperscalers
    • By Edition
      • Web Admin Edition
      • Web Pro Edition
      • Web Host Edition
      • Business & Collaboration
      • WP Edition
    • By Cloud
      • Amazon Web Services
      • Microsoft Azure
      • Alibaba Cloud
      • GCP Marketplace
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
    • Partner Program
      • Partner Program
  • Product
    Explore Features
    • Everyone
    • Admins & Web Hosters
    • Developers
    • Designers & Agencies
    • Plesk Features
    • Everyone
    • Admins & Web Hosters
    • Developers
    • Designers & Agencies
    • Plesk Features
    Key Topics
    • SocialBee
    • WP Toolkit
    • Sitejet Builder
    • SEO Toolkit
    • Joomla! Toolkit
    • Plesk Premium Email
    • Plesk Email Security
    • SocialBee
    • WP Toolkit
    • Sitejet Builder
    • SEO Toolkit
    • Joomla! Toolkit
    • Plesk Premium Email
    • Plesk Email Security
    Feature Packs
    • Business & Collaboration
    • WP Pack
    • Hosting Pack
    • Power Pack
    • Language Pack
    • Business & Collaboration
    • WP Pack
    • Hosting Pack
    • Power Pack
    • Language Pack
    Featured Extension
    SocialBee
    • Explore Features
      • Everyone
      • Admins & Web Hosters
      • Developers
      • Designers & Agencies
      • Plesk Features
    • Key Topics
      • SocialBee
      • WP Toolkit
      • Sitejet Builder for Plesk
      • SEO Toolkit
      • Plesk Premium Email
      • Plesk Email Security
    • Feature Packs
      • Business & Collaboration
      • WP Pack
      • Hosting Pack
      • Power Pack
      • Language Pack
    • Featured Extension
      • Extension
  • Pricing
  • Extensions
  • Help Center
  • More
    • Careers
    • Events
    • Plesk University
  • FREE TRIAL
  • Solutions
    • By Role
      • Developers
      • Content Managers
      • Digital Agencies
      • IT Admins
      • Web Hosters
      • Hyperscalers
    • By Edition
      • Web Admin Edition
      • Web Pro Edition
      • Web Host Edition
      • Business & Collaboration
      • WP Edition
    • By Cloud
      • Amazon Web Services
      • Microsoft Azure
      • Alibaba Cloud
      • GCP Marketplace
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
    • Partner Program
      • Partner Program
  • Product
    • Explore Features
      • Everyone
      • Admins & Web Hosters
      • Developers
      • Designers & Agencies
      • Plesk Features
    • Key Topics
      • SocialBee
      • WP Toolkit
      • Sitejet Builder
      • SEO Toolkit
      • Joomla! Toolkit
      • Plesk Premium Email
      • Plesk Email Security
    • Feature Packs
      • Business & Collaboration
      • WP Pack
      • Hosting Pack
      • Power Pack
      • Language Pack
    • Featured Extension
      • SocialBee
  • Pricing
  • Extensions
  • Help center
  • More
    • Careers
    • Events
    • Plesk University
    • Blog
    • Plesk Partner Program
    • Contact Us
  • FREE TRIAL
  • Solutions
    • By Role
      • Developers
      • Content Managers
      • Digital Agencies
      • IT Admins
      • Web Hosters
      • Hyperscalers
    • By Edition
      • Web Admin Edition
      • Web Pro Edition
      • Web Host Edition
      • Business & Collaboration
      • WP Edition
    • By Cloud
      • Amazon Web Services
      • Microsoft Azure
      • Alibaba Cloud
      • GCP Marketplace
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
    • Partner Program
      • Partner Program
  • Product
    • Explore Features
      • Everyone
      • Admins & Web Hosters
      • Developers
      • Designers & Agencies
      • Plesk Features
    • Key Topics
      • SocialBee
      • WP Toolkit
      • Sitejet Builder
      • SEO Toolkit
      • Joomla! Toolkit
      • Plesk Premium Email
      • Plesk Email Security
    • Feature Packs
      • Business & Collaboration
      • WP Pack
      • Hosting Pack
      • Power Pack
      • Language Pack
    • Featured Extension
      • SocialBee
  • Pricing
  • Extensions
  • Help center
  • More
    • Careers
    • Events
    • Plesk University
    • Blog
    • Plesk Partner Program
    • Contact Us
  • FREE TRIAL

Knowledge Base

Microsoft Windows Server 2008R2, Server 2012, Server 2012R2 and Server 2016 are vulnerable to Juicy Potato exploit

 
hostedhostingmicrosoftobsidianos

Situation

Microsoft Windows Server in its default configuration has a critical vulnerability, that can cause an escalation of privileges if a server is compromised. In a context of multi-tenant Plesk use (shared hosting) this allows a Plesk client to upload special scripts in their subscription to obtain Administrator privileges for the server.

Is this vulnerability in Plesk?

No, this is a vulnerability in the Microsoft Windows Server. Plesk itself configures IIS accounts the same way as IIS itself on a clean server without Plesk installed at all.
However, to track all details about the vulnerability it is addressed by Plesk Development Team as an internal entity with ID PFSI-61569.

Is my server affected?

The following versions of Windows are affected:

  • Windows Server 2008 R2
  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2016

Windows Server 2019 is not affected by this vulnerability.

Will the vulnerability be fixed by Microsoft?

Microsoft does not offer hardening recommendations for versions of Windows Server prior to 2019 due to architectural implementation in operating systems. The official recommendation is “Using Windows Server 2019 would mitigate this attack vector”.

What can I do?

Plesk recommends updating the installation to Plesk Obsidian 18.0.32 or newer. The security was improved in this version. The improvements include measures against this vulnerability.

If it can not be done for any reasons:

  1. As a workaround, disable DCOM support on the server according to the Microsoft article for affected versions of Windows Server.

    Note: The server restart is required for changes to take effect. These changes will mitigate the vulnerability, and existing exploits will not work anymore.

  2. Migrate to Plesk on Windows Server 2019, since this OS version is not affected by the vulnerability.

Note: The notification in Plesk is not hidden automatically after applying the solution. To hide it, click I got it and understand the risk.

Are there any risks of applying the proposed solution?

DCOM is not used by Plesk, and main Plesk usage scenarios have been tested with it disabled.

However, it may be used by hosted websites, and this action may somehow affect their functionality. Disabling DCOM may also affect environments located in the Windows Domain.

If any issues in the infrastructure not related to Plesk occur after applying the workaround, contact Microsoft directly.

Tweet
Share
Share
Email
0 Shares
Read the full article
Related Posts

Plesk Obsidian 18.0.62 is now available

Read More »

Plesk Obsidian 18.0.61 Release

Read More »

Securing the WordPress Frontier with WP Guardian

Read More »
Knowledge Base

How to set default index type for a domain in Plesk Obsidian

Read More »

Is Plesk on Windows Server 2012 supported?

Read More »

How to customize permissions allowing access to additional files and directories for Plesk on Windows users through Disk Security?

Read More »

How to configure Plesk if primary DNS zones for domains reside on external nameservers?

Read More »

Hosting Wiki

  • Cross Site Request Forgery (CSRF)
  • Content Security Policy ( CSP )
  • Cross-Origin Resource Sharing (CORS)
  • Server Redundancy
  • Postfix
  • PostgreSQL
  • DDoS
  • Bare Metal Server
  • Oracle VM Server
  • Server Virtualization Software
  • Windows Server
  • Hosting Control Panel
  • Plesk
  • NoSQL Database
  • Web Server
  • DNS Server
  • Colocation Hosting
  • Reseller Hosting
  • Cloud Hosting
  • VPS Hosting
  • Dedicated Hosting
  • Shared Hosting
  • Free Hosting
  • Managed Hosting

Industry
Partners

industry-partner_ALIBABA
industry-partner_GOOGLEPARTNER
industry-partner_MICROSOFT
industry-partner_REDHAT-r2
industry-partner_ALIBABA
industry-partner_AUTOMATTIC
industry-partner_AWS
industry-partner_DIGITALOCEAN
industry-partner_SCALEWAY
Follow us:
Facebook Twitter Linkedin Youtube Github

COMPANY

About Plesk
Our Brand
Legal
Careers
Impressum

PRODUCT

Pricing 
Extensions
What’s new

KNOWLEDGE BASE

Documentation
Help Center
Migrate to Plesk
Contact Us
Hosting Wiki
Preview releases

PROGRAMS

Contributor Program NEW
Partner Program
Affiliate ProgramNEW

COMMUNITY

Blog
Forums 
Plesk University

First defaul

Company

About Plesk
Our Brand
Legal
Careers
Impressum

PRODUCT

Pricing 
Extensions
What’s new

KNOWLEDGE BASE​

Documentation
Help Center
Migrate to Plesk
Contact Us
Hosting Wiki
Preview releases

PROGRAMS​

Contributor Program NEW
Partner Program
Affiliate ProgramNEW

COMMUNITY​

Blog
Forums
Plesk University

Follow us:
Facebook Twitter Linkedin Youtube Github

© 2025 WebPros International GmbH. All rights reserved. Plesk and the Plesk logo are trademarks of WebPros International GmbH.

Managed with love with Plesk WP Toolkit