CVE-2013-4878

Published: Jul 18, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.

Affected (3)

Products: Parallels: Parallels Plesk Panel, Parallels Small Business Panel

2 products

Parallels Plesk Panel

Parallels Small Business Panel

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Parallels Parallels Plesk Panel	Version 9.0
Parallels Parallels Plesk Panel	Version 9.2
Parallels Parallels Small Business Panel	Version 10.0

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

References (6)

http://kb.parallels.com/116241

Source: cve@mitre.org

Vendor Advisory

http://seclists.org/fulldisclosure/2013/Jun/21

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/673343

Source: cve@mitre.org

US Government Resource

http://kb.parallels.com/116241

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://seclists.org/fulldisclosure/2013/Jun/21

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/673343

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.