8

CVE-2024-8069

Warnung

Limited remote code execution with privilege of a NetworkService Account access

Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Citrix ≫ Session Recording SwEdition - Version < 2407
Citrix ≫ Session Recording Version 1912 Update - SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu1 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu2 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu3 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu4 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu5 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu6 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu7 SwEdition ltsr
Citrix ≫ Session Recording Version 1912 Update cu8 SwEdition ltsr
Citrix ≫ Session Recording Version 2203 Update - SwEdition ltsr
Citrix ≫ Session Recording Version 2203 Update cu1 SwEdition ltsr
Citrix ≫ Session Recording Version 2203 Update cu2 SwEdition ltsr
Citrix ≫ Session Recording Version 2203 Update cu3 SwEdition ltsr
Citrix ≫ Session Recording Version 2203 Update cu4 SwEdition ltsr
Citrix ≫ Session Recording Version 2402 Update - SwEdition ltsr
Citrix ≫ Session Recording Version 2407 Update - SwEdition -

25.08.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Schwachstelle

Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 14.64% 0.964
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8 2.1 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
secure@citrix.com 5.1 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8069
US Government Resource