CVE-2020-35710

{"id": "CVE-2020-35710", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-12-25T19:15:13.177", "references": [{"url": "https://twitter.com/amadapa/status/1342407005110218753", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a \"host\" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like \"host\":\"192.168.###.###\" in the POST data."}, {"lang": "es", "value": "Parallels Remote Application Server (RAS) versi\u00f3n 18, permite a atacantes remotos detectar una direcci\u00f3n IP de intranet porque el env\u00edo del formulario de inicio de sesi\u00f3n (inclusive con credenciales en blanco) proporciona esta direcci\u00f3n al cliente del atacante para usarla como valor de \"host\". En otras palabras, despu\u00e9s de que el navegador web de un atacante envi\u00f3 una petici\u00f3n hacia el formulario de inicio de sesi\u00f3n, podr\u00eda autom\u00e1ticamente enviar una segunda petici\u00f3n hacia un URI RASHTML5Gateway/socket.io con algo como \"host\":\"192.168.###.###\" en los datos POST"}], "lastModified": "2020-12-30T16:00:20.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:parallels:remote_application_server:18.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B246B73-F911-4579-A091-D92584323B04"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}