PT-2012-3344 · Parallels · Parallels Plesk Panel

Henri Salo · Published 2012-03-12 · Updated 2018-01-11 · CVE-2012-1557

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel versions 7.x through 8.x before 8.6 MU#2 Parallels Plesk Panel versions 9.x before 9.5 MU#11 Parallels Plesk Panel versions 10.0.x before MU#13 Parallels Plesk Panel versions 10.1.x before MU#22 Parallels Plesk Panel versions 10.2.x before MU#16 Parallels Plesk Panel versions 10.3.x before MU#5

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. This issue has been exploited in the wild in March 2012.

Recommendations For Parallels Plesk Panel versions 7.x through 8.x before 8.6 MU#2, update to 8.6 MU#2 or later. For Parallels Plesk Panel versions 9.x before 9.5 MU#11, update to 9.5 MU#11 or later. For Parallels Plesk Panel versions 10.0.x before MU#13, update to MU#13 or later. For Parallels Plesk Panel versions 10.1.x before MU#22, update to MU#22 or later. For Parallels Plesk Panel versions 10.2.x before MU#16, update to MU#16 or later. For Parallels Plesk Panel versions 10.3.x before MU#5, update to MU#5 or later.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-1557

Affected Products

Parallels Plesk Panel

References · 13

• http://secunia.com/advisories/48262 · Vendor Advisory
• http://kb.parallels.com/en/113321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1557 · Security Note
• http://openwall.com/lists/oss-security/2012/03/08/3 · Note
• http://cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73628 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1557 · Note
• http://securitytracker.com/id?1026760 · Note
• http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216 · Note
• http://osvdb.org/79769 · Note
• http://h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html · Note
• http://securityfocus.com/bid/52267 · Note
• http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216 · Note