PT-2011-5079 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2019-04-22 · CVE-2011-4749

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.3.1 build1013110726.09

Description The issue concerns the billing system of Parallels Plesk Panel, where a password form field is generated without disabling the autocomplete feature. This makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation. Specifically, the vulnerability is demonstrated by forms on certain pages under admin/index.php/default.

Recommendations For Parallels Plesk Panel version 10.3.1 build1013110726.09, consider disabling the autocomplete feature for password form fields as a temporary workaround to minimize the risk of exploitation. Restrict access to the billing system and admin/index.php/default pages to authorized personnel only.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2011-4749

Produtos afetados

Parallels Plesk Panel

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4749 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4749 · Nota de Segurança
• http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72260 · Nota