Products
Parallels Desktop Software
- before 19.3.0
Source
cve-coordination@incibe.es
Tags
CVE-2024-6240 details
Published : June 21, 2024, 2:15 p.m.
Last Modified : June 21, 2024, 3:58 p.m.
Last Modified : June 21, 2024, 3:58 p.m.
Description
Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-269 | Improper Privilege Management | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
7.7
Exploitability Score
1.3
Impact Score
5.8
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
References
| URL | Source |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/improper-privilege-management-vulnerability-parallels-desktop | cve-coordination@incibe.es |
This website uses the NVD API, but is not approved or certified by it.