CVE-2011-4764

Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Wizard/Edit/Modules/Image and certain other files.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/72216
http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/72216

Configurations

Configuration 1 (hide)

cpe:2.3:a:parallels:parallels_plesk_small_business_panel:10.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2011-12-16 11:55

Updated : 2025-04-11 00:51

NVD link : CVE-2011-4764

Mitre link : CVE-2011-4764

CVE.ORG link : CVE-2011-4764

JSON object : View

Products Affected

parallels

parallels_plesk_small_business_panel

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2011-4764", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2011-12-16T11:55:12.033", "references": [{"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72216", "source": "cve@mitre.org"}, {"url": "http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72216", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Wizard/Edit/Modules/Image and certain other files."}, {"lang": "es", "value": "Multiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad \"Site Editor\" (SiteBuilder) de Parallels Plesk Small Business Panel 10.2.0. Permite a atacantes remotos inyectar codigo de script web o c\u00f3digo HTML de su elecci\u00f3n a trav\u00e9s de una entrada modificada a un script PHP, tal como se ha demostrado en \"Wizard/Edit/Modules/Image\" y otros determinados ficheros."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:parallels:parallels_plesk_small_business_panel:10.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2300F00A-0B6A-4DCA-9BBF-BAC863BE2443"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}