PT-2011-5091 · Parallels · Parallels Plesk Small Business Panel

Publicado 2011-12-16 · Atualizado 2017-08-29 · CVE-2011-4761

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0

Description The issue is related to the omission of the Content-Type header's charset parameter for certain resources, which could allow remote attackers to have an unspecified impact. This might be achieved by leveraging an interpretation conflict involving domains/sitebuilder edit.php and certain other files. It is noted that possibly only clients, not the product itself, could be affected by this issue.

Recommendations For Parallels Plesk Small Business Panel version 10.2.0, consider configuring the Content-Type header to include the charset parameter for the affected resources as a temporary workaround. Restrict access to the domains/sitebuilder edit.php file and other involved files to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2011-4761

Produtos afetados

Parallels Plesk Small Business Panel

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72213 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4761 · Nota de Segurança
• http://xss.cx/examples/plesk-reports/plesk-10.2.0.html · Nota