Vulnerability · Published Dec 17, 2021 · Assigned by INCIBE

CVE-2020-8968Parallels Remote Application Server credentials management errors

High 7.1

In plain English

A high-severity security flaw in Parallels Remote Application Server (Client) from Parallels. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password.

Affected products (as reported)

Vendor	Product	Versions
Parallels	Parallels Remote Application Server (Client)	15.5 – through 17

Weakness: CWE-255 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors x_refsource_CONFIRM