Lucene search

[email protected]CVE-2011-4856

HistoryDec 16, 2011 - 11:55 a.m.

CVE-2011-4856

2011-12-1611:55:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2011-4856

parallels

plesk panel

control panel

content-type header

vulnerability

nvd

7.6 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

73.3%

JSON

The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/health/parameters and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.

CPENameOperatorVersion
parallels:parallels_plesk_panelparallels parallels plesk paneleq10.4.4_build20111103.18

CPE	Name	Operator	Version
parallels:parallels_plesk_panel	parallels parallels plesk panel	eq	10.4.4_build20111103.18

References

xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html

exchange.xforce.ibmcloud.com/vulnerabilities/72091

7.6 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for CVE-2011-4856

prion1 cvelist1