PT-2014-5495 · Citrix · Citrix Vdi-In-A-Box

Published 2014-05-30 · Updated 2014-06-24 · CVE-2014-3780

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix VDI-In-A-Box versions 5.3.x through 5.3.7 Citrix VDI-In-A-Box versions 5.4.x through 5.4.3

Description The issue allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet.

Recommendations For versions 5.3.x through 5.3.7, update to version 5.3.8 or later. For versions 5.4.x through 5.4.3, update to version 5.4.4 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-3780

Affected Products

Citrix Vdi-In-A-Box

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-3780 · Security Note
• http://support.citrix.com/article/CTX140779 · Vendor Advisory
• http://securityfocus.com/bid/67687 · Note
• http://securitytracker.com/id/1030305 · Note
• http://secunia.com/advisories/58431 · Note