CVE-2020-15860 — CRITICAL (9.9)

Vulnerability Description

Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.

CVSS Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Parallels	Remote Application Server	17.1.1

References

https://kb.parallels.com/en/125112Vendor Advisory
https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execuExploitThird Party Advisory
https://www.parallels.com/products/ras/remote-application-server/Product
https://kb.parallels.com/en/125112Vendor Advisory
https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execuExploitThird Party Advisory
https://www.parallels.com/products/ras/remote-application-server/Product

FAQ

What is CVE-2020-15860?

CVE-2020-15860 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system th...

How severe is CVE-2020-15860?

CVE-2020-15860 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-15860?

Check the references section above for vendor advisories and patch information. Affected products include: Parallels Remote Application Server.