CVE-2017-9447 In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gat...
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary files from the vulnerable system using path traversal sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| parallels remote application server | = 15.5 | No fix listed |
References
- blog.runesec.com exploit third-party-advisory
- 442321 broken-link exploit