CVE-2011-4749

The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default.

Score

CVSS 2.0 10.0 Critical

Status

Modified - cve@mitre.org

Published

2011-12-16

Last modified

2024-08-07

Weaknesses

CWE-255

Affected products

• Parallels Plesk Panel (Parallels)

References

• http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billi…
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72260