PT-2011-5140 · Parallels · Parallels Plesk Panel

Published 2011-12-16 · Updated 2017-08-29 · CVE-2011-4849

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18

Description The issue concerns the Control Panel in Parallels Plesk Panel, which fails to set the secure flag for a cookie in an https session. This oversight makes it easier for remote attackers to capture the cookie by intercepting its transmission within an http session. The vulnerability is demonstrated by cookies used by help.php and certain other files.

Recommendations For Parallels Plesk Panel version 10.4.4 build20111103.18, consider setting the secure flag for cookies manually to prevent them from being transmitted over insecure connections until a patch is available. As a temporary workaround, restrict access to help.php and other affected files to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-4849

Affected Products

Parallels Plesk Panel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4849 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72224 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4849 · Note
• http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html · Note