CVE-2020-15860

 

Published at: - 24-07-2020 06:15

Last modified: - 20-01-2023 09:49

Total changes: - 2

Description

Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution
• https://www.parallels.com/products/ras/remote-application-server/
• https://kb.parallels.com/en/125112

 

Keywords

NVD

 

CVE-2020-15860

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures