CVE-2024-6240CWE-269

Improper privilege management vulnerability in Parallels Desktop

High · published June 21, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-06-21T13:33Z
EPSS history
Timeline
  • 21 JUN 13:33Z
    Improper privilege management vulnerability in Parallels Desktop
    cvelistv5