CVE-2011-4749

Published: Dec 16, 2011Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default.

Affected (1)

Products: Parallels: Parallels Plesk Panel

1 product

Parallels Plesk Panel

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Parallels Parallels Plesk Panel	Version 10.3.1_build1013110726.09

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0

Related CWEs

References (4)

http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/72260

Source: cve@mitre.org

http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/72260

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.