PT-2007-1510 · Citrix · Citrix Access Gateway

Published 2007-11-05 · Updated 2018-10-16 · CVE-2007-0011

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix Access Gateway versions prior to Advanced Edition 4.5 HF1

Description The issue affects the web portal interface, allowing context-dependent attackers to hijack sessions by reading residual information, including referer logs, browser history, or browser cache, due to the session ID being placed in the URL.

Recommendations For versions prior to Advanced Edition 4.5 HF1, update to Advanced Edition 4.5 HF1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and clearing browser history and cache regularly to minimize the risk of session hijacking.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-0011

Affected Products

Citrix Access Gateway

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2007-0011 · Security Note
• http://securityfocus.com/bid/24975 · Patch
• http://secunia.com/advisories/26143 · Vendor Advisory
• http://support.citrix.com/article/CTX112803 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35510 · Note
• http://securityfocus.com/archive/1/482626/100/100/threaded · Note
• http://vupen.com/english/advisories/2007/2583 · Note
• http://support.citrix.com/article/CTX113814 · Note
• http://securitytracker.com/id?1018435 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0011 · Note
• http://osvdb.org/45288 · Note