Vulnerability Details : CVE-2022-34899
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16134.
Vulnerability category: Execute code
Products affected by CVE-2022-34899
- cpe:2.3:a:parallels:parallels_access:6.5.4_\(39316\):*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-34899
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 19 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-34899
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.0
|
HIGH | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
Zero Day Initiative | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2022-34899
-
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.Assigned by: zdi-disclosures@trendmicro.com (Primary)
References for CVE-2022-34899
-
https://www.zerodayinitiative.com/advisories/ZDI-22-947/
ZDI-22-947 | Zero Day InitiativeThird Party Advisory;VDB Entry
-
https://kb.parallels.com/en/129010
Parallels Access Security UpdatesVendor Advisory
Jump to