Privilege escalation to NetworkService Account access (Citrix Citrix Session Recording)
En bref
- Source
- NVD
- EPSS
- EPSS 3.48 % · centile 89 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Citrix
- Statut NVD
- Analyzed
Description
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
Faiblesses (CWE)
- CWE-269 — Gestion incorrecte des privilèges
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | Citrix |
| CVSS 4.0 | MEDIUM 5.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · secure@citrix.com (Secondary) |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-49530
- GCVE · GCVE-0-2024-8068
Avis du CERT-FR
- CERTFR-2024-AVI-0964 — Multiples vulnérabilités dans les produits Citrix · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:citrix:session_recording:*:*:*:*:-:*:*:*< 2407cpe:2.3:a:citrix:session_recording:1912:-:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu1:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu2:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu3:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu4:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu5:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu6:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu7:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:1912:cu8:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2203:-:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2203:cu1:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2203:cu2:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2203:cu3:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2203:cu4:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2203:cu5:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2402:-:*:*:ltsr:*:*:*cpe:2.3:a:citrix:session_recording:2407:-:*:*:-:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Citrix · Citrix Session Recording | affected 2407 Current Release < 24.5.200.8 ; affected 1912 LTSR < CU9 hotfix 19.12.9100.6 ; affected 2203 LTSR < CU5 hotfix 22.03.5100.11 ; affected 2402 LTSR < CU1 hotfix 24.02.1200.16 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |