CVE-2011-4756: Infoleak
Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilderedit.php and certain other files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4756?
CVE-2011-4756 has a moderate severity rating due to the potential for sensitive information leakage via script access.
How do I fix CVE-2011-4756?
To fix CVE-2011-4756, ensure that the HTTPOnly flag is set for cookies in the application configuration.
Which software versions are affected by CVE-2011-4756?
CVE-2011-4756 specifically affects Parallels Plesk Small Business Panel version 10.2.0.
What type of attack does CVE-2011-4756 facilitate?
CVE-2011-4756 facilitates cross-site scripting attacks by allowing remote attackers to access cookies without the HTTPOnly protection.
Is upgrading to a newer version a solution for CVE-2011-4756?
Yes, upgrading to a version of Parallels Plesk Small Business Panel that implements the HTTPOnly flag will mitigate the vulnerability.