PT-2011-5145 · Parallels · Parallels Plesk Panel

Published 2011-12-16 · Updated 2017-08-29 · CVE-2011-4854

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18

Description The issue is related to the Control Panel in Parallels Plesk Panel, where it does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements. This might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving the get enabled product icon program. It is possible that only clients, not the Plesk product, could be affected by this issue.

Recommendations For Parallels Plesk Panel version 10.4.4 build20111103.18, consider restricting access to the get enabled product icon program as a temporary workaround until a patch is available. Additionally, ensure proper configuration of Content-Type HTTP headers to match the corresponding Content-Type data in HTML META elements.

Fix

Related Identifiers

CVE-2011-4854

Affected Products

Parallels Plesk Panel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4854 · Security Note
• http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72093 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4854 · Note