Vulnerability Details CVE-2022-40870
The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 32.0%
CVSS Severity
CVSS v3 Score 8.1
References
- https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txt
- https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServer
- https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txt
- https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServer
Products affected by CVE-2022-40870
-
cpe:2.3:a:parallels:remote_application_server:18.0