PT-2020-19468 · Parallels · Parallels

Published 2020-01-21 · Updated 2020-01-29 · CVE-2020-7213

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parallels versions prior to 13

Description The issue allows for man-in-the-middle attacks due to the use of cleartext HTTP as part of the update process. Users of out-of-date versions are presented with a pop-up window for a parallels updates.xml file on the http://update.parallels.com web site.

Recommendations For versions prior to 13, update to version 13 or later to resolve the issue. As a temporary workaround, consider restricting access to the http://update.parallels.com web site to minimize the risk of exploitation.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-7213

Affected Products

Parallels

References · 5

• 🔥 http://almorabea.net/en/2020/01/19/write-up-for-the-parallel-vulnerability-cve-2020-7213 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7213 · Security Note
• https://parallels.com · Vendor Advisory
• http://almorabea.net/cves/cve-2020-7213.txt · Note