PT-2023-29752 · Parallels · Parallels Ras

Published 2023-12-11 · Updated 2023-12-20 · CVE-2023-45894

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parallels RAS versions prior to 19.2.23975

Description The issue allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques because the Remote Application Server in Parallels RAS does not segment virtualized applications from the server.

Recommendations For versions prior to 19.2.23975, update to version 19.2.23975 or later to resolve the issue. As a temporary workaround, consider restricting access to the Remote Application Server to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-45894

Affected Products

Parallels Ras

References · 6

• 🔥 https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-45894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45894 · Security Note
• https://t.me/cvenotify/64448 · Telegram Post
• https://twitter.com/CVEnew/status/1735383564479545621 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734323414171525342 · Twitter Post