VulnerabilityModified
CVE-2001-0908
CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation (NAT).
HIGH 7.5EPSS 1.41%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation (NAT).
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Affected
- citrix/metaframe
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=100638693315933&w=2
- http://www.securityfocus.com/bid/3566Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7538
- http://marc.info/?l=bugtraq&m=100638693315933&w=2
- http://www.securityfocus.com/bid/3566Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7538
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.