Privilege Escalation Vulnerability in Citrix Virtual Apps and Desktops
CVE-2021-22928

7.8HIGH

Key Information:

Vendor

Citrix
Status
Citrix Virtual Apps And Desktops
Vendor
CVE Published:
5 August 2021

What is CVE-2021-22928?

A vulnerability exists in Citrix Virtual Apps and Desktops that could permit an attacker with access to a Windows Virtual Delivery Agent (VDA) utilizing either Citrix Profile Management or Citrix Profile Management WMI Plugin to escalate their privileges to SYSTEM level. This could lead to unauthorized access and control over system resources, jeopardizing the integrity and security of the affected systems.

Affected Version(s)

Citrix Virtual Apps and Desktops 2106 HF1, 1912LTSR CU3 HF1, 7.15LTSR CU7 HF1

References

https://support.citrix.com/article/CTX319750
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-22928 : Privilege Escalation Vulnerability in Citrix Virtual Apps and Desktops