Command Execution Vulnerability in Citrix Virtual Apps and Desktops
CVE-2020-8269

8.8HIGH

Key Information:

Vendor
Citrix
Status
Citrix Virtual Apps And Desktops
Vendor
CVE Published:
16 November 2020

Summary

A vulnerability exists in Citrix Virtual Apps and Desktops that allows unprivileged Windows users on the Virtual Delivery Agent (VDA) to execute arbitrary commands with SYSTEM privileges. This issue affects multiple versions, including those prior to 2009, as well as specific hotfixes for the 1912 LTSR and LTSR versions 7.15 and 7.6. Proper updates and fixes are necessary to safeguard systems against potential exploitation.

Affected Version(s)

Citrix Virtual Apps and Desktops 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9

References

https://support.citrix.com/article/CTX285059
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.