Sign-up

ID

VAR-201111-0322


TITLE

Parallels Plesk Panel Cross-Site Scripting Vulnerability

Trust: 0.8

sources: IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4599

DESCRIPTION

Plesk is a comprehensive control panel solution for managing your site. A cross-site scripting vulnerability exists in Parallels Plesk Panel. Since some unspecified input is not properly filtered before being returned to the user, an attacker can exploit the vulnerability to execute arbitrary HTML and script code in the user's browser session of the affected site context. ---------------------------------------------------------------------- Ovum says ad hoc tools are out-dated. The best practice approach? Fast vulnerability intelligence, threat handling, and setup in one tool. Read the new report on the Secunia VIM: http://secunia.com/products/corporate/vim/ovum_2011_request/ ---------------------------------------------------------------------- TITLE: Parallels Plesk Panel Cross-Site Scripting and SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA46158 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46158/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46158 RELEASE DATE: 2011-10-30 DISCUSS ADVISORY: http://secunia.com/advisories/46158/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/46158/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=46158 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: David Hoyt has reported multiple vulnerabilities in Parallels Plesk Panel, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks. 1) Certain unspecified input is not properly sanitised before being returned to the user. The vulnerabilities are reported in versions 10.0 through 10.2. SOLUTION: Update to version 10.3 or apply patch. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: David Hoyt ORIGINAL ADVISORY: David Hoyt: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html Parallels: http://kb.parallels.com/112403 http://kb.parallels.com/112402 http://kb.parallels.com/112401 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.53

sources: CNVD: CNVD-2011-4600 // CNVD: CNVD-2011-4599 // IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d // IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d // PACKETSTORM: 106394

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.6

sources: IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d // IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4600 // CNVD: CNVD-2011-4599

AFFECTED PRODUCTS

vendor:parallelsmodel:plesk panelscope:eqversion:10.0-10.2

Trust: 1.6

sources: IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d // IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4600 // CNVD: CNVD-2011-4599

CVSS

SEVERITY

CVSSV2

CVSSV3

IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

sources: IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d // IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d

TYPE

SQL injection

Trust: 0.2

sources: IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d

PATCH

title:Parallels Plesk Panel SQL Injection Vulnerability Patchurl:https://www.cnvd.org.cn/patchinfo/show/5742

Trust: 0.6

title:Patch for Parallels Plesk Panel Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchinfo/show/5743

Trust: 0.6

sources: CNVD: CNVD-2011-4600 // CNVD: CNVD-2011-4599

EXTERNAL IDS

db:SECUNIAid:46158

Trust: 1.3

db:CNVDid:CNVD-2011-4600

Trust: 0.8

db:CNVDid:CNVD-2011-4599

Trust: 0.8

db:IVDid:6AE08CD6-1F81-11E6-ABEF-000C29C66E3D

Trust: 0.2

db:IVDid:6C8B1DD0-1F81-11E6-ABEF-000C29C66E3D

Trust: 0.2

db:PACKETSTORMid:106394

Trust: 0.1

sources: IVD: 6ae08cd6-1f81-11e6-abef-000c29c66e3d // IVD: 6c8b1dd0-1f81-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-4600 // CNVD: CNVD-2011-4599 // PACKETSTORM: 106394

REFERENCES

url:http://secunia.com/advisories/46158/

Trust: 1.3

url:http://secunia.com/advisories/46158/#comments

Trust: 0.1

url:http://secunia.com/vulnerability_intelligence/

Trust: 0.1

url:http://secunia.com/advisories/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

Trust: 0.1

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=46158

Trust: 0.1

url:http://kb.parallels.com/112401

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/personal/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html

Trust: 0.1

url:http://kb.parallels.com/112402

Trust: 0.1

url:http://kb.parallels.com/112403

Trust: 0.1

url:http://secunia.com/products/corporate/vim/ovum_2011_request/

Trust: 0.1

url:http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html

Trust: 0.1

url:http://secunia.com/advisories/about_secunia_advisories/

Trust: 0.1

sources: CNVD: CNVD-2011-4600 // CNVD: CNVD-2011-4599 // PACKETSTORM: 106394

CREDITS

Secunia

Trust: 0.1

sources: PACKETSTORM: 106394

SOURCES

db:IVDid:6ae08cd6-1f81-11e6-abef-000c29c66e3d
db:IVDid:6c8b1dd0-1f81-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-4600
db:CNVDid:CNVD-2011-4599
db:PACKETSTORMid:106394

LAST UPDATE DATE

2022-05-17T22:50:05.125000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2011-4600date:2011-11-01T00:00:00
db:CNVDid:CNVD-2011-4599date:2011-11-01T00:00:00

SOURCES RELEASE DATE

db:IVDid:6ae08cd6-1f81-11e6-abef-000c29c66e3ddate:2011-11-01T00:00:00
db:IVDid:6c8b1dd0-1f81-11e6-abef-000c29c66e3ddate:2011-11-01T00:00:00
db:CNVDid:CNVD-2011-4600date:2011-11-01T00:00:00
db:CNVDid:CNVD-2011-4599date:2011-11-01T00:00:00
db:PACKETSTORMid:106394date:2011-10-31T07:52:11