CVE-2011-4765: Infoleak
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4765?
The severity of CVE-2011-4765 is considered to be high due to the potential exposure of sensitive information via XSS attacks.
How do I fix CVE-2011-4765?
To fix CVE-2011-4765, update to a version of Parallels Plesk Small Business Panel that correctly implements the HTTPOnly flag in Set-Cookie headers.
What are the potential impacts of CVE-2011-4765?
The potential impacts of CVE-2011-4765 include unauthorized access to sensitive cookie information by remote attackers.
Which versions of Parallels Plesk Small Business Panel are affected by CVE-2011-4765?
CVE-2011-4765 specifically affects Parallels Plesk Small Business Panel version 10.2.0.
Can I mitigate the risks associated with CVE-2011-4765 without applying a patch?
Mitigation of risks associated with CVE-2011-4765 without a patch is challenging; however, limiting access to the web application and employing additional security measures like Web Application Firewalls may help.