CVE-2011-4749 | BDVDB-2026-48515 Detail

Description#

The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/72260

Exploit#

No public exploit known

History#

Version 12011-12-16Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.