PT-2011-5085 · Parallels · Parallels Plesk Small Business Panel

Published 2011-12-16 · Updated 2017-08-29 · CVE-2011-4755

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0

Description The issue arises from improper validation of string data intended for storage in an XML document. This can be exploited by remote attackers through crafted cookies, potentially leading to a denial of service due to parsing errors or other unspecified impacts. Attackers can craft cookies to specific files, such as client@1/domain@1/hosting/file-manager/, to exploit this issue.

Recommendations For Parallels Plesk Small Business Panel version 10.2.0, consider restricting access to the file-manager and other sensitive files until a proper fix is available. As a temporary workaround, validate all string data intended for XML documents to prevent parsing errors.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4755

Affected Products

Parallels Plesk Small Business Panel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4755 · Security Note
• http://xss.cx/examples/plesk-reports/plesk-10.2.0.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72207 · Note