PT-2011-5057 · Parallels · Parallels Plesk Panel

Published 2011-12-16 · Updated 2019-04-22 · CVE-2011-4727

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build1011110331.18

Description The issue concerns the Server Administration Panel in Parallels Plesk Panel, where it fails to properly validate string data intended for storage in an XML document. This can be exploited by remote attackers through a crafted REST URL parameter, potentially causing a denial of service due to a parsing error or having other unspecified impacts. This can be achieved by manipulating parameters to certain files, such as those accessed through the "admin/" endpoint.

Recommendations For Parallels Plesk Panel version 10.2.0 build1011110331.18, consider restricting access to the REST API endpoints, such as "admin/", to minimize the risk of exploitation until a proper fix is available. Additionally, avoid using crafted URL parameters that could trigger the parsing error or unspecified other impacts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4727

Affected Products

Parallels Plesk Panel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4727 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72332 · Note
• http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4727 · Note