PT-2011-5079 · Parallels · Parallels Plesk Panel

Published 2011-12-16 · Updated 2019-04-22 · CVE-2011-4749

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.3.1 build1013110726.09

Description The issue concerns the billing system of Parallels Plesk Panel, where a password form field is generated without disabling the autocomplete feature. This makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation. Specifically, the vulnerability is demonstrated by forms on certain pages under admin/index.php/default.

Recommendations For Parallels Plesk Panel version 10.3.1 build1013110726.09, consider disabling the autocomplete feature for password form fields as a temporary workaround to minimize the risk of exploitation. Restrict access to the billing system and admin/index.php/default pages to authorized personnel only.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2011-4749

Affected Products

Parallels Plesk Panel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4749 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4749 · Note
• http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72260 · Note