CVE-2022-40870

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txtExploit, Third Party Advisory
https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServerExploit, Third Party Advisory
https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txtExploit, Third Party Advisory
https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServerExploit, Third Party Advisory

Timeline

Published: Nov 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-408719.8Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr CVE-2022-408729.8An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, class CVE-2022-408747.5Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial CVE-2022-408757.5Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.CVE-2022-408769.8In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overfl CVE-2022-408779.8Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.CVE-2022-408788.8In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Exe CVE-2022-408796.1kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'CVE-2022-40889.8A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality CVE-2022-408819.8SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php CVE-2022-408845.5Bento4 1.6.0 has memory leaks via the mp4fragment.CVE-2022-408855.5Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.