Vulnerability · Published Jul 10, 2023 · Assigned by Citrix
CVE-2023-24490Users with only access to launch VDA applications can launch an unauthorized desktop
Medium 6.3
In plain English
A medium-severity improper access control in Virtual Delivery Agents for Linux for CVAD and Citrix DaaS Security from Citrix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Users with only access to launch VDA applications can launch an unauthorized desktop
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Citrix | Virtual Delivery Agents for Windows for CVAD and Citrix DaaS Security | Current Release (CR) 0 – before 2305 Long Term Service Release (LTSR) 0 – before 2203 LTSR CU3Long Term Service Release (LTSR) 0 – before 1912 LTSR CU7 |
| Citrix | Virtual Delivery Agents for Linux for CVAD and Citrix DaaS Security | Current Release (CR) 0 – before 2305Long Term Service Release (LTSR) 0 – before 2203 LTSR CU3Long Term Service Release (LTSR) 0 – before 1912 LTSR CU7 hotfix 1(19.12.7001) |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L