PT-2022-7158 · Parallels · Parallels Desktop

Published 2022-11-01 · Updated 2025-08-06 · CVE-2023-27323

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parallels Desktop (affected versions not specified)

Description The issue is related to the Updater service of Parallels Desktop, where a Time-Of-Check Time-Of-Use flaw allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this flaw. The specific flaw exists within the Updater service, where an attacker can create a symbolic link to abuse the service and execute a file, potentially escalating privileges and executing arbitrary code in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

LPE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2023-08422

CVE-2023-27323

ZDI-23-217

Affected Products

Parallels Desktop

References · 9

• https://zerodayinitiative.com/advisories/ZDI-23-217 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27323 · Vendor Advisory
• https://kb.parallels.com/125013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27323 · Security Note
• https://bdu.fstec.ru/vul/2023-08422 · Security Note
• https://vuldb.com/ru/?id.224596 · Note
• https://t.me/cveNotify/131160 · Telegram Post
• https://t.me/cvenotify/78936 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1786273472538189842 · Twitter Post