PT-2011-5068 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2019-04-22 · CVE-2011-4738

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build 20110407.20

Description The issue allows remote attackers to obtain potentially sensitive information via script access to cookies. This is because the Control Panel in the affected software does not include the HTTPOnly flag in a Set-Cookie header for a cookie. The cookies used by get password.php and certain other files are affected.

Recommendations For Parallels Plesk Panel version 10.2.0 build 20110407.20, consider configuring the software to include the HTTPOnly flag in Set-Cookie headers to prevent unauthorized script access to sensitive cookies. As a temporary workaround, restrict access to the affected files, such as get password.php, to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-4738

Produtos afetados

Parallels Plesk Panel

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72321 · Nota
• http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4738 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4738 · Nota