CVE-2024-6240

CVSS 7.7v3.1pub. 2024-06-21upd. 2024-11-21

Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Parallels Desktop
APP
Parallels
< 19.3.0

🔵

ZWERYFIKUJ U PRODUCENTA

Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.

Tagi

LPE

CWE

CWE-269

Referencje

www.incibe.es/en/incibe-cert/notices/aviso/improper-pri…

Powiązane podatności

CVE-2024-54189HIGH7.8ten sam produkt

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version...

CVE-2025-31359HIGH8.8ten sam produkt

A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop fo...

CVE-2024-36486HIGH7.8ten sam produkt

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parall...

CVE-2024-52561HIGH7.8ten sam produkt

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version...

CVE-2024-6153HIGH7.8ten sam produkt

Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability al...