PT-2011-5059 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2019-04-22 · CVE-2011-4729

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build1011110331.18

Description The issue concerns the Server Administration Panel in Parallels Plesk Panel, where the HTTPOnly flag is not included in a Set-Cookie header for a cookie. This omission makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. The cookies used by login up.php3 and certain other files are affected.

Recommendations For Parallels Plesk Panel version 10.2.0 build1011110331.18, consider configuring the Set-Cookie header to include the HTTPOnly flag to prevent unauthorized script access to sensitive cookies. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2011-4729

Produtos afetados

Parallels Plesk Panel

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4729 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4729 · Nota de Segurança
• http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72330 · Nota