High NCSC-2024-0288 7 CVEs

Kwetsbaarheden verholpen in Citrix Workspace, NetScaler ADC en NetScaler Gateway

Published Jul 10, 2024 · Updated Jul 11, 2024 · Revision 2 · nl

Vendor: Citrix Vendor: NetScaler Vendor: NetSclaer Product: Agent Product: application_delivery_management Product: Citrix Provisioning Product: Citrix Workspace app for HTML5 Product: Citrix Workspace app for Windows Product: NetScaler ADC Product: NetScaler ADC Product: NetScaler Console Product: NetScaler Gateway Product: NetScaler Gateway Product: netscaler_agent Product: netscaler_application_delivery_controller Product: netscaler_console Product: netscaler_gateway_firmware Product: netscaler_svm Product: provisioning_services Product: SDX Product: virtual_apps_and_desktops Product: Windows Virtual Delivery Agent Product: workspace Product: WorkSpace App

Summary

Cirtix heeft een aantal kwetsbaarheden verholpen in Workspace, NetScaler ADC en NetScaler Gateway

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Denial-of-Service (DoS)
* Manipulatie van gegevens
* Verhoogde gebruikersrechten

Oplossingen
Citrix heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Voor meer informatie, zie bijgevoegde referenties.

Vulnerabilities 7

High 8.5

CVE-2024-6151

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS

Citrix Windows Virtual Delivery Agent Windows Network devices

Jul 10, 2024
High 8.5

CVE-2024-6286

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows

Citrix Citrix Workspace app for Windows Windows Network devices

Jul 10, 2024
High 7.2

CVE-2024-5491

Denial of Service

Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler

NetScaler NetScaler Gateway NetScaler ADC

Jul 10, 2024
High 7.1

CVE-2024-6236

Denial of Service

Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX

NetScaler NetSclaer Agent NetScaler Console

Jul 10, 2024
Medium 5.3

CVE-2024-6148

Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5

Citrix Citrix Workspace app for HTML5 Network devices

Jul 10, 2024
Medium 5.1

CVE-2024-5492

Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites

Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway

NetSclaer NetScaler ADC

Jul 10, 2024
Medium 4.8

CVE-2024-6150

A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning

Citrix Citrix Provisioning Network devices

Jul 10, 2024

Revision history

2024-07-11 #1
De volgende CVE's zijn toegevoegd: * CVE-2024-6286 * CVE-2024-2636 * CVE-2024-6151 * CVE-2024-6150 * CVE-2024-6748
2024-07-10 #0
Initiele versie

References

Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-5491
Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-5492
Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-6148
Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-6150
Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-6151
Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-6236
Source - first
https://api.first.org/data/v1/epss?cve=CVE-2024-6286
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-5491
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-5492
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-6148
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-6150
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-6151
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-6236
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-6286
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-5491
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-5492
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-6148
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-6150
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-6151
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-6236
Source - cveprojectv5
https://www.cve.org/CVERecord?id=CVE-2024-6286
Reference - cveprojectv5; nvd
https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492
Reference - certbundde
https://support.citrix.com/article/CTX677998/netscaler-console-agent-and-svm-security-bulletin-for-cve20246235-and-cve20246236
Reference - certbundde
https://support.citrix.com/article/CTX678035/windows-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve20246151
Reference - certbundde
https://support.citrix.com/article/CTX678036/citrix-workspace-app-for-windows-security-bulletin-cve20246286
Reference - certbundde
https://support.citrix.com/article/CTX678037/citrix-workspace-app-for-html5-security-bulletin-cve20246148-and-cve20246149