CVE-2020-8209

EPSS 48.66%
Veröffentlicht 17.08.2020 16:15:13
Zuletzt bearbeitet 21.11.2024 05:38:30
Erkennungen
Login

Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 18 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Citrix ≫ Xenmobile Server Version <= 10.8.0

Citrix ≫ Xenmobile Server Version 10.9.0 Update -

Citrix ≫ Xenmobile Server Version 10.9.0 Update rolling_patch1

Citrix ≫ Xenmobile Server Version 10.9.0 Update rolling_patch2

Citrix ≫ Xenmobile Server Version 10.9.0 Update rolling_patch3

Citrix ≫ Xenmobile Server Version 10.9.0 Update rolling_patch4

Citrix ≫ Xenmobile Server Version 10.10.0 Update -

Citrix ≫ Xenmobile Server Version 10.10.0 Update rolling_patch1

Citrix ≫ Xenmobile Server Version 10.10.0 Update rolling_patch2

Citrix ≫ Xenmobile Server Version 10.10.0 Update rolling_patch3

Citrix ≫ Xenmobile Server Version 10.10.0 Update rolling_patch4

Citrix ≫ Xenmobile Server Version 10.10.0 Update rolling_patch5

Citrix ≫ Xenmobile Server Version 10.11.0 Update -

Citrix ≫ Xenmobile Server Version 10.11.0 Update rolling_patch1

Citrix ≫ Xenmobile Server Version 10.11.0 Update rolling_patch2

Citrix ≫ Xenmobile Server Version 10.11.0 Update rolling_patch3

Citrix ≫ Xenmobile Server Version 10.12.0 Update -

Citrix ≫ Xenmobile Server Version 10.12.0 Update rolling_patch1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	48.66%	0.987

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://support.citrix.com/article/CTX277457

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-8209

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-8209

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-8209

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-8209