PT-2015-5834 · Citrix · Citrix Command Center

Cengiz Han Sahin · Published 2015-03-26 · Updated 2019-02-05 · CVE-2015-2682

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix Command Center versions prior to 5.1 Build 35.4 Citrix Command Center versions prior to 5.2 Build 42.7

Description The issue allows remote attackers to obtain credentials by making a direct request to the conf/securitydbData.xml file.

Recommendations For versions prior to 5.1 Build 35.4, update to Build 35.4 or later. For versions prior to 5.2 Build 42.7, update to Build 42.7 or later.

Exploit

Fix

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-2682

Affected Products

Citrix Command Center

References · 8

• 🔥 https://exploit-db.com/exploits/36441 · Exploit
• 🔥 http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html · Exploit
• 🔥 https://securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2682 · Security Note
• http://support.citrix.com/article/CTX200584 · Vendor Advisory
• http://seclists.org/fulldisclosure/2015/Mar/126 · Note
• http://securityfocus.com/bid/73309 · Note
• http://securitytracker.com/id/1031993 · Note