CVE-2020-7213

HIGH

Parallels 13 - Cleartext Storage of Sensitive Information via HTTP Update Process

Title source: llm
STIX 2.1

Description

Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a parallels_updates.xml file on the http://update.parallels.com web site.

References (3)

Core 3
Core References
Product, Vendor Advisory x_refsource_misc
https://parallels.com
Third Party Advisory x_refsource_misc
http://almorabea.net/cves/cve-2020-7213.txt

Scores

CVSS v3 7.5
EPSS 0.0109
EPSS Percentile 61.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-312
Status published
Products (1)
parallels/parallels 13
Published Jan 21, 2020
Tracked Since Feb 18, 2026