Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for some reason crashes, any user can start a new server on port 8443 and imitate Plesk (right?).
Of course, this user won't have the right certificate. But especially cheap hosts use a self-signed certificate for the Plesk panel anyway, so nobody would notice if it's a different self-signed certificate.
Supposing someone could get access to some normal account on the server, and he could somehow (possibly being lucky) get the Plesk server to crash, he could imitate the Plesk panel and steal the credentials of users who are logging in.
All of this wouldn't be a problem if Parallels Plesk would be using a port under 1024. Am I right in this? Is this a real issue, or does it not really matter?