Critical severity · published Jul 24, 2020
CVE-2020-15860
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution
9.9
CVSS
4%
EPSS
No
On KEV
Description
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Remote Application Server · Parallels
17.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15860
Vendor Advisory
https://kb.parallels.com/en/125112
Exploit
https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution
Product
https://www.parallels.com/products/ras/remote-application-server/
More from Remote Application Server
10.0
CVE-2023-45894
The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code…
8.1
CVE-2022-40870
The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks
7.8
CVE-2025-0413
Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability
7.5
CVE-2017-9447
In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource…
7.1
CVE-2020-8968
Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by…