In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary files from the vulnerable system using path traversal sequences.
References
| Link | Resource |
|---|---|
| https://blog.runesec.com/2018/02/22/parallels-ras-path-traversal/ | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/442321/ | Broken Link |
| https://blog.runesec.com/2018/02/22/parallels-ras-path-traversal/ | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/442321/ | Broken Link |
Configurations
History
21 Nov 2024, 03:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.runesec.com/2018/02/22/parallels-ras-path-traversal/ - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/442321/ - Broken Link |
Information
Published : 2018-02-28 15:29
Updated : 2024-11-21 03:36
NVD link : CVE-2017-9447
Mitre link : CVE-2017-9447
CVE.ORG link : CVE-2017-9447
JSON object : View
Products Affected
parallels
- remote_application_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')