PT-2015-5834 · Citrix · Citrix Command Center

Cengiz Han Sahin · Publicado 2015-03-26 · Atualizado 2019-02-05 · CVE-2015-2682

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix Command Center versions prior to 5.1 Build 35.4 Citrix Command Center versions prior to 5.2 Build 42.7

Description The issue allows remote attackers to obtain credentials by making a direct request to the conf/securitydbData.xml file.

Recommendations For versions prior to 5.1 Build 35.4, update to Build 35.4 or later. For versions prior to 5.2 Build 42.7, update to Build 42.7 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2015-2682

Produtos afetados

Citrix Command Center

Referências · 8

• 🔥 https://exploit-db.com/exploits/36441 · Exploit
• 🔥 http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html · Exploit
• 🔥 https://securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2682 · Nota de Segurança
• http://seclists.org/fulldisclosure/2015/Mar/126 · Nota
• http://support.citrix.com/article/CTX200584 · Aviso do Fabricante
• http://securityfocus.com/bid/73309 · Nota
• http://securitytracker.com/id/1031993 · Nota