CVEvulnerability
CVE-2013-4878
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-07-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.
Affected configurations
• parallels parallels plesk panel 9.0
• parallels parallels plesk panel 9.2
• parallels parallels small business panel 10.0
Related
Weakness · not in database (1)
References
- http://kb.parallels.com/116241 Vendor Advisory
- http://seclists.org/fulldisclosure/2013/Jun/21 seclists.org
- http://www.kb.cert.org/vuls/id/673343 US Government Resource
- http://kb.parallels.com/116241 Vendor Advisory
- http://seclists.org/fulldisclosure/2013/Jun/21 seclists.org
- http://www.kb.cert.org/vuls/id/673343 US Government Resource