CVE-2011-4740: Infoleak
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4740?
CVE-2011-4740 is classified as a medium severity vulnerability due to its potential for sensitive information exposure.
How do I fix CVE-2011-4740?
To mitigate CVE-2011-4740, it's recommended to upgrade to a later version of Parallels Plesk Panel that doesn't contain this vulnerability.
What types of attacks can exploit CVE-2011-4740?
CVE-2011-4740 can be exploited through cross-site scripting attacks that expose sensitive information via crafted GET requests.
What software versions are affected by CVE-2011-4740?
CVE-2011-4740 specifically affects Parallels Plesk Panel version 10.2.0 build 20110407.20.
Is there a workaround for CVE-2011-4740?
A temporary workaround for CVE-2011-4740 is to restrict access to the Control Panel or implement input validation on GET requests.