PT-2023-3995 · Citrix · Citrix Secure Access Client For Windows

Publicado 2023-07-11 · Atualizado 2023-07-19 · CVE-2023-24491

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Citrix Secure Access client for Windows (affected versions not specified)

Description A vulnerability has been discovered in the Citrix Secure Access client for Windows, which, if exploited, could allow an attacker with access to an endpoint with a Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT AUTHORITYSYSTEM. The issue is related to insecure privilege management.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2023-04293

CVE-2023-24491

Produtos afetados

Citrix Secure Access Client For Windows

Referências · 8

• https://t.me/true_secator/4607 · Publicação no Telegram
• https://support.citrix.com/article/CTX561480/citrix-secure-access-client-for-windows-security-bulletin-for-cve202324491 · Aviso do Fabricante
• https://t.me/cibsecurity/66455 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-24491 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-24491 · Aviso do Fabricante
• https://t.me/sysadm_in_channel/4748 · Publicação no Telegram
• https://support.citrix.com/article/CTX564169/citrix-secure-access-client-for-ubuntu-security-bulletin-for-cve202324491 · Nota
• https://bdu.fstec.ru/vul/2023-04293 · Nota de Segurança