Description

Multiple vulnerabilities were reported in Parallels Plesk Sitebuilder. Parallels Plesk comes with an ISAPI filter named sitepreview.dll. This filter can be abused to bypass the firewall restrictions and access the Sitebuilder interface on port 2006. Using this interface an attacker can upload and execute arbitrary code.

Remediation

Upgrade to the latest version of Parallels Plesk.

References

Multiple Vulnerabilities in Parallels Plesk Sitebuilder

Parallels Plesk Sitebuilder

Related Vulnerabilities

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Remote Code Execution (2.05.01)

Sitecore XP TemplateParser RCE (CVE-2023-35813)

Python Debugger Unauthorized Access Vulnerability

Oracle Weblogic Async Component Deserialization RCE CVE-2019-2725

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-35150)

Severity

High

Classification

CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Arbitrary File Creation Code Execution