Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability

CVE-2023-27328

What is CVE-2023-27328?

A local privilege escalation vulnerability exists in the Toolgate component of Parallels Desktop. This flaw arises from insufficient validation of user-supplied strings when constructing XML documents. Attackers who can execute low-privileged code on a targeted guest operating system can exploit this vulnerability to elevate their privileges and potentially execute arbitrary code within the context of the hypervisor. It is crucial for users to monitor updates and apply necessary patches to mitigate the risks associated with this vulnerability.

References