Vulnerability Name:

CVE-2011-4852 (CCN-72095)

Assigned:2011-11-20
Published:2011-11-20
Updated:2017-08-29
Summary:The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.5 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2011-4852

Source: CCN
Type: OSVDB ID: 77903
Parallels Plesk Panel Control Panel Multiple Script Cross-Domain Referer Leakage Multiple Web-Server Log Information Disclosure (2011-4852)

Source: CCN
Type: Parallels Web Site
CVE-2011-4776, CVE-2011-4777, XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, BHDB, Parallels Plesk Panel v10.4.4_build20111103.18 os_Windows 2003/2008

Source: MISC
Type: Exploit
http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html

Source: XF
Type: UNKNOWN
plesk-external-info-disc(72095)

Source: XF
Type: UNKNOWN
plesk-external-info-disc(72095)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:parallels:parallels_plesk_panel:10.4.4_build20111103.18:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:parallels:parallels_plesk_panel:10.4.4:build20111103.18:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    parallels parallels plesk panel 10.4.4_build20111103.18
    microsoft windows 2003 server *
    microsoft windows server 2008 -
    parallels parallels plesk panel 10.4.4 build20111103.18