Parallels Plesk Panel CVE-2011-4776 Cross-Site Scripting Vulnerability

Bugtraq ID:	73886
Class:	Input Validation Error
CVE:	CVE-2011-4776
Remote:	Yes
Local:	No
Published:	Dec 16 2011 12:00AM
Updated:	Dec 16 2011 12:00AM
Credit:	Unknown
Vulnerable:	Parallels Parallels Plesk Panel 10.4.4 Build20111103
Not Vulnerable:

Parallels Plesk Panel CVE-2011-4776 Cross-Site Scripting Vulnerability

Parallels Plesk Panel is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.

Parallels Plesk Panel CVE-2011-4776 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Parallels Plesk Panel CVE-2011-4776 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Parallels Plesk Panel CVE-2011-4776 Cross-Site Scripting Vulnerability

References:

• CVE-2011-4776, CVE-2011-4777, XSS, Reflected Cross Site Scripting, CWE-79, CAPEC (MISC)
  
• IBM X-Force Exchange Beta (XF)