Vulnerability · Published Jun 21, 2024 · Assigned by INCIBE
CVE-2024-6240Improper privilege management vulnerability in Parallels Desktop
High 7.7
In plain English
A high-severity privilege mismanagement in Parallels Desktop from Parallels. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Parallels | Parallels Desktop | 0 – before 19.3.0 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N