Limited remote code execution with privilege of a NetworkService Account access
CVE-2024-8069

5.1MEDIUM

Key Information:

Vendor

Citrix Session Recording

Status
Citrix Session Recording
Vendor
CVE Published:
12 November 2024

Badges

👾 Exploit Exists🟣 EPSS 44%🦅 CISA Reported📰 News Worthy

What is CVE-2024-8069?

The vulnerability presents an opportunity for authenticated users on the same intranet as the Citrix Session Recording server to execute remote code with the privileges of a NetworkService Account. This can potentially lead to unauthorized data access or modification, emphasizing the need for robust network defenses and user access controls to mitigate the risk of exploitation.

CISA has reported CVE-2024-8069

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-8069 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Citrix Session Recording 2407 Current Release < 24.5.200.8

Citrix Session Recording 1912 LTSR

Citrix Session Recording 2203 LTSR

News Articles

favicon imageCyberSecurityNews

Citrix Virtual Apps & Desktops RCE Vulnerability, PoC Exploitation Underway

Security researchers have disclosed critical vulnerabilities in Citrix Virtual Apps and Desktops that could allow remote code execution (RCE) attacks.

References

https://support.citrix.com/s/article/CTX691941-citrix-ses...

EPSS Score

44% chance of being exploited in the next 30 days.

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by CyberSecurityNews

  • Vulnerability published

.
CVE-2024-8069 : Limited remote code execution with privilege of a NetworkService Account access