PT-2011-5057 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2019-04-22 · CVE-2011-4727

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build1011110331.18

Description The issue concerns the Server Administration Panel in Parallels Plesk Panel, where it fails to properly validate string data intended for storage in an XML document. This can be exploited by remote attackers through a crafted REST URL parameter, potentially causing a denial of service due to a parsing error or having other unspecified impacts. This can be achieved by manipulating parameters to certain files, such as those accessed through the "admin/" endpoint.

Recommendations For Parallels Plesk Panel version 10.2.0 build1011110331.18, consider restricting access to the REST API endpoints, such as "admin/", to minimize the risk of exploitation until a proper fix is available. Additionally, avoid using crafted URL parameters that could trigger the parsing error or unspecified other impacts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-4727

Produtos afetados

Parallels Plesk Panel

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72332 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4727 · Nota de Segurança
• http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4727 · Nota