PT-2011-5085 · Parallels · Parallels Plesk Small Business Panel

Publicado 2011-12-16 · Atualizado 2017-08-29 · CVE-2011-4755

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0

Description The issue arises from improper validation of string data intended for storage in an XML document. This can be exploited by remote attackers through crafted cookies, potentially leading to a denial of service due to parsing errors or other unspecified impacts. Attackers can craft cookies to specific files, such as client@1/domain@1/hosting/file-manager/, to exploit this issue.

Recommendations For Parallels Plesk Small Business Panel version 10.2.0, consider restricting access to the file-manager and other sensitive files until a proper fix is available. As a temporary workaround, validate all string data intended for XML documents to prevent parsing errors.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-4755

Produtos afetados

Parallels Plesk Small Business Panel

Referências · 3

• http://xss.cx/examples/plesk-reports/plesk-10.2.0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4755 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72207 · Nota