PT-2015-5835 · Citrix+1 · Citrix Command Center+1

Cengiz Han Sahin · Publicado 2015-03-26 · Atualizado 2018-10-09 · CVE-2015-2683

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix Command Center versions prior to 5.1 Build 35.4 Citrix Command Center versions prior to 5.2 Build 42.7

Description The issue is related to improper access restriction to the Advent Java Management Extensions (JMX) Servlet. This allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx dynamic.

Recommendations For versions prior to 5.1 Build 35.4, update to Build 35.4 or later to resolve the issue. For versions prior to 5.2 Build 42.7, update to Build 42.7 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-2683

Produtos afetados

Advent Java Management Extensions (Jmx) Servlet

Citrix Command Center

Referências · 8

• 🔥 http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html · Exploit
• 🔥 https://securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2683 · Nota de Segurança
• http://securityfocus.com/archive/1/534933/100/0/threaded · Nota
• http://securityfocus.com/bid/73313 · Nota
• http://support.citrix.com/article/CTX200584 · Nota
• http://seclists.org/fulldisclosure/2015/Mar/127 · Nota
• http://securitytracker.com/id/1031993 · Nota