PT-2011-5145 · Parallels · Parallels Plesk Panel

Publicado 2011-12-16 · Atualizado 2017-08-29 · CVE-2011-4854

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18

Description The issue is related to the Control Panel in Parallels Plesk Panel, where it does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements. This might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving the get enabled product icon program. It is possible that only clients, not the Plesk product, could be affected by this issue.

Recommendations For Parallels Plesk Panel version 10.4.4 build20111103.18, consider restricting access to the get enabled product icon program as a temporary workaround until a patch is available. Additionally, ensure proper configuration of Content-Type HTTP headers to match the corresponding Content-Type data in HTML META elements.

Correção

Identificadores relacionados

CVE-2011-4854

Produtos afetados

Parallels Plesk Panel

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72093 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4854 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4854 · Nota
• http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html · Aviso do Fabricante