NVD

Id
11099  
Name
CVE-2011-4749  
Description
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2011-12-16  
Modified Date
2012-01-17  
Seq
2011-4749  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
61702 11099 CVE-2011-4749 plesk-billing-system-sec-bypass(72260)  View
61703 11099 CVE-2011-4749 http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
33199 JVNDB-2011-003439 Parallels Plesk Panel の billing system における認証を回避される脆弱性 Parallels Plesk Panel の billing system には、オートコンプリート機能を無効にしないまま、password form フィールドを生成することで、認証を回避される脆弱性が存在します。 CVE-2011-4749 52656 CVE-2011-4749 11099 10 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-003439.html 2011-12-16 2011-12-20 View