VulnerabilityModified
CVE-2020-8270
An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342
HIGH 8.8EPSS 3.48%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.48% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- citrix/virtual apps and desktops
- Source
- support@hackerone.com
References
- https://support.citrix.com/article/CTX285059Patch, Vendor Advisory
- https://support.citrix.com/article/CTX285059Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.