Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability
CVE-2023-27328

7.8HIGH

Key Information:

Vendor

Parallels

Status
Desktop
Vendor
CVE Published:
3 May 2024

What is CVE-2023-27328?

A local privilege escalation vulnerability exists in the Toolgate component of Parallels Desktop. This flaw arises from insufficient validation of user-supplied strings when constructing XML documents. Attackers who can execute low-privileged code on a targeted guest operating system can exploit this vulnerability to elevate their privileges and potentially execute arbitrary code within the context of the hypervisor. It is crucial for users to monitor updates and apply necessary patches to mitigate the risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Desktop 18.0.2

References

https://www.zerodayinitiative.com/advisories/ZDI-23-220/
x_research-advisory
https://kb.parallels.com/125013
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.