PT-2011-5141 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2011-12-16 · CVE-2011-4850

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18

Description The issue allows remote attackers to obtain potentially sensitive information via script access to cookies. This is because the Control Panel does not include the HTTPOnly flag in a Set-Cookie header for a cookie, making it easier for attackers to access this cookie through scripts, as seen in cookies used by help.php and other files.

Recommendations For Parallels Plesk Panel version 10.4.4 build20111103.18, consider configuring the Set-Cookie header to include the HTTPOnly flag to prevent script access to sensitive cookies.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-4850

Produtos afetados

Parallels Plesk Panel

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4850 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4850 · Nota
• http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html · Nota