PT-2014-6063 · Citrix · Citrix Xendesktop

Published 2014-07-11 · Updated 2018-12-18 · CVE-2014-4700

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:A/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix XenDesktop versions 4.x through 7.x

Description The issue allows local guest users to gain access to another user's desktop via unspecified vectors when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled.

Recommendations For versions 4.x through 7.x, consider enabling ShutdownDesktopsAfterUse to prevent unauthorized access to desktops. Additionally, restrict access to pooled random desktop groups to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-4700

Affected Products

Citrix Xendesktop

References · 6

• http://support.citrix.com/article/CTX139591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4700 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94460 · Note
• http://secunia.com/advisories/59889 · Note
• http://securityfocus.com/bid/68530 · Note
• http://securitytracker.com/id/1030566 · Note