CVE:CVE-2011-4765
CNNVD:CNNVD-201112-326
Parallels Plesk Small Business Panel 10.2.0版本的Site Editor (也称为SiteBuilder)功能中存在漏洞，此功能在cookie的Set-Cookie头中未包含HTTPOnly标志。远程攻击者可借助访问该cookie的脚本获取敏感信息，该漏洞已在Wizard/Edit/Modules/ImageGallery/MultiImagesUpload和某些其他文件使用的cookies中被证实。
solution:Upgrade parallels parallels_plesk_small_business_panel to a higher version than 10.2.0,and avoid the version 10.2.0