CVE-2022-40870

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks

High · published November 22, 2022

CVSS v3.1
8.1
EPSS
2%
Percentile
81.3
In the wild
Unconfirmed
What it is

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02070 · 81.3th percentile
Published
2022-11-22T00:00Z
EPSS history
Timeline
  • 22 NOV 00:00Z
    The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks
    cvelistv5