CVE-2011-4756

Parallels Plesk Small Business Panel 10.2.0 - Exposure of Sensitive Information via Missing HTTPOnly Cookie Flag

Title source: llm
STIX 2.1

Description

Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilder_edit.php and certain other files.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/72208

Scores

EPSS 0.0116
EPSS Percentile 63.4%

Details

CWE
CWE-200
Status published
Products (1)
parallels/parallels_plesk_small_business_panel 10.2.0
Published Dec 16, 2011
Tracked Since Feb 18, 2026