Lucene search

ZdiCVE-2021-31427

HistoryApr 29, 2021 - 5:15 p.m.

CVE-2021-31427

2021-04-2917:15:09

CWE-367

CWE-667

zdi

web.nvd.nist.gov

cve-2021-31427

parallels desktop

vulnerability

disclosure

sensitive information

open tools gate

nvd

zdi-can-13082

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

15.9%

JSON

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Open Tools Gate component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13082.

Affected configurations

Nvd

Vulners

Node

parallelsparallels_desktopMatch15.1.5-47309

VendorProductVersionCPE
parallelsparallels_desktop15.1.5-47309cpe:2.3:a:parallels:parallels_desktop:15.1.5-47309:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
parallels	parallels_desktop	15.1.5-47309	cpe:2.3:a:parallels:parallels_desktop:15.1.5-47309:::::::*

CNA Affected

[
  {
    "product": "Desktop",
    "vendor": "Parallels",
    "versions": [
      {
        "status": "affected",
        "version": "15.1.5-47309"
      }
    ]
  }
]

References

kb.parallels.com/en/125013

www.zerodayinitiative.com/advisories/ZDI-21-435/

Social References

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

15.9%

JSON

Related for CVE-2021-31427