PT-2024-5728 · Citrix · Citrix Virtual Apps/Desktops+2

Published 2024-06-18 · Updated 2024-08-01 · CVE-2024-6151

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Citrix Virtual Delivery Agent for Windows (affected versions not specified)

Description The issue is related to insecure privilege management in the Virtual Delivery Agent for Windows component of Citrix Virtual Apps and Desktops and Citrix DaaS. This allows a low-privileged user to gain SYSTEM privileges, enabling potential exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2024-06441

CVE-2024-6151

Affected Products

Citrix Daas

Citrix Virtual Apps/Desktops

Citrix Virtual Delivery Agent For Windows

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-6151 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6151 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06441 · Security Note
• https://t.me/cvedetector/594 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024071064 · Note
• https://vuldb.com/?id.270889 · Note
• https://support.citrix.com/article/CTX678035 · Note
• https://twitter.com/the_yellow_fall/status/1810858778444849565 · Twitter Post
• https://twitter.com/CVEnew/status/1811322695570895321 · Twitter Post
• https://twitter.com/CveFindCom/status/1811136109956530559 · Twitter Post
• https://twitter.com/ThomasPreischl/status/1810705378952265923 · Twitter Post