CVE-2020-35710

Katalog CVE

CVSS 5.3 · Medium EPSS 1,7%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada parallels remote application server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.

Rincian

Terbit di NVD

25 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://twitter.com/amadapa/status/1342407005110218753 advisory pihak ketiga
• https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html exploit · advisory pihak ketiga