7.8

CVE-2023-24485

Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows

Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Citrix ≫ Workspace SwEdition - SwPlatform windows Version < 2212
Citrix ≫ Workspace Version 1912 Update - SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu1 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu1-hf1 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu2 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu3 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu4 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu5 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 1912 Update cu6 SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 2203.1 Update - SwEdition ltsr SwPlatform windows
Citrix ≫ Workspace Version 2203.1 Update cu1 SwEdition ltsr SwPlatform windows
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.121
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://support.citrix.com/article/CTX477617/citrix-workspace-app-for-windows-security-bulletin-for-cve202324484-cve202324485
Patch
Vendor Advisory