CVE-2020-11584: 
NixOS vulnerability analysis and mitigation

A GET-based XSS (Cross-Site Scripting) reflected vulnerability was discovered in Plesk Onyx 17.8.11, identified as CVE-2020-11584. The vulnerability allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. This vulnerability was disclosed on August 3, 2020 (NVD).

The vulnerability is classified as a reflected XSS issue with a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows attackers to execute arbitrary JavaScript, HTML, or CSS code in the context of the victim's browser session. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated user's session (NVD).

The vulnerability can be exploited by an unauthenticated remote attacker by sending a specially crafted GET request containing malicious JavaScript, HTML, or CSS code. A proof of concept exists demonstrating the vulnerability can be triggered by accessing a specifically crafted URL (Medium Blog).

Users should upgrade to a version newer than Plesk Onyx 17.8.11. No specific workarounds have been publicly documented for this vulnerability (NVD).