Remote Code Execution Vulnerability in Parallels Remote Application Server
CVE-2023-45894

10CRITICAL

Key Information:

Vendor

Parallels

Status
Remote Application Server
Vendor
CVE Published:
14 December 2023

What is CVE-2023-45894?

A vulnerability in the Parallels Remote Application Server prior to version 19.2.23975 allows a remote attacker to execute arbitrary code. The issue arises because the system does not sufficiently isolate virtualized applications from the underlying server infrastructure. This lack of segmentation can be exploited by an attacker using common kiosk breakout techniques, posing significant risks to system integrity and data security.

References

https://github.com/Oracle-Security/CVEs/blob/main/Paralle...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.