PT-2011-5058 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2019-04-22 · CVE-2011-4728

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build1011110331.18

Description The issue concerns the Server Administration Panel in Parallels Plesk Panel, where it fails to set the secure flag for a cookie in an https session. This makes it easier for remote attackers to capture the cookie by intercepting its transmission within an http session. The cookies used by login up.php3 and certain other files are affected.

Recommendations For Parallels Plesk Panel version 10.2.0 build1011110331.18, consider setting the secure flag for cookies manually to prevent them from being transmitted over http sessions. As a temporary workaround, restrict access to the Server Administration Panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-4728

Produtos afetados

Parallels Plesk Panel

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72331 · Nota
• http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4728 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4728 · Nota