Vulnerability · Published May 3, 2024 · Assigned by zdi

CVE-2023-27323Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

High 7.8

In plain English

A high-severity security flaw in Desktop from Parallels. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.0)7.8High

Exploit odds (30 days)0.2%top 89.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. . Was ZDI-CAN-18150.

Affected products (as reported)

Vendor	Product	Versions
Parallels	Desktop	18.0.0 (53049)

Weakness: CWE-367 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

ZDI-23-217 x_research-advisory
vendor-provided URL vendor-advisory