PT-2011-5076 · Parallels · Parallels Plesk Panel

Published 2011-12-16 · Updated 2019-04-22 · CVE-2011-4746

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.3.1 build1013110726.09

Description The issue concerns the billing system of Parallels Plesk Panel, which fails to disable the SSL 2.0 protocol. This oversight allows remote attackers to exploit weaknesses in the protocol, making it easier to conduct spoofing attacks.

Recommendations For Parallels Plesk Panel version 10.3.1 build1013110726.09, consider disabling the SSL 2.0 protocol to prevent exploitation. As a temporary workaround, restrict access to the billing system until a more permanent solution is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-4746

Affected Products

Parallels Plesk Panel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4746 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4746 · Note
• http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html · Note