CVE-2024-6240: Improper privilege management vulnerability in Parallels Desktop
Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASHENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parallels Desktopto a version that resolves this vulnerability.Fixed in 19.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6240?
CVE-2024-6240 is rated as a high severity vulnerability due to improper privilege management that can lead to the execution of malicious code.
How do I fix CVE-2024-6240?
To fix CVE-2024-6240, upgrade Parallels Desktop to version 19.3.0 or later.
What versions of Parallels Desktop are affected by CVE-2024-6240?
CVE-2024-6240 affects all versions of Parallels Desktop prior to 19.3.0.
What type of vulnerability is CVE-2024-6240?
CVE-2024-6240 is classified as an improper privilege management vulnerability.
Can CVE-2024-6240 lead to remote code execution?
Yes, CVE-2024-6240 could potentially allow an attacker to execute arbitrary code on the affected system.