CVE-2020-15860: parallels remote application server

csirt@kutim:~/threat-intel/cve/CVE-2020-15860

CVSS 9.9 · Critical EPSS 4,0%

Kerentanan pada parallels remote application server. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.

Rincian

Terbit di NVD: 24 Juli 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 4,0% peluang dieksploitasi; lebih tinggi dari 90,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
parallels	remote application server	Versi 17.1.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://kb.parallels.com/en/125112 advisory vendor
https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution exploit · advisory pihak ketiga
https://www.parallels.com/products/ras/remote-application-server/ product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.