CVE-2022-34901: Parallels Access Agent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The service executes files from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16137.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The service executes files from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-34901?
CVE-2022-34901 is a vulnerability that allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent.
How does CVE-2022-34901 work?
CVE-2022-34901 works by leveraging an uncontrolled search path element to execute low-privileged code and escalate privileges on the target host system.
What is the severity of CVE-2022-34901?
The severity of CVE-2022-34901 is high, with a severity value of 7.8.
Which software versions are affected by CVE-2022-34901?
CVE-2022-34901 affects installations of Parallels Access 6.5.4 (39316) Agent.
How can CVE-2022-34901 be fixed?
To fix CVE-2022-34901, users should update to a patched version of Parallels Access as soon as it becomes available.