PT-2024-4265 · Citrix · Xenserver+1

Published 2024-06-11 · Updated 2024-10-28 · CVE-2024-5661

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Citrix Hypervisor versions 8.2 CU1 LTSR XenServer version 8

Description The issue is related to improper rate limiting in an endpoint, which may allow an attacker to cause a denial of service. A malicious administrator of a guest VM can exploit this to make the host slow and/or unresponsive.

Recommendations For Citrix Hypervisor version 8.2 CU1 LTSR, update to a version that includes the fix for this issue. For XenServer version 8, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable endpoint to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-799

Related Identifiers

BDU:2024-04752

CVE-2024-5661

Affected Products

Citrix Hypervisor

Xenserver

References · 7

• https://support.citrix.com/article/CTX677100/xenserver-and-citrix-hypervisor-security-update-for-cve20245661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5661 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5661 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04752 · Security Note
• https://t.me/cvenotify/85029 · Telegram Post
• https://t.me/cvenotify/83105 · Telegram Post
• https://vuldb.com/?id.268072 · Note