CVE-2002-2426
Severity:
Pending analysis
Type:
CWE-352
Cross-Site Request Forgery (CSRF)
Publication date:
31/12/2002
Last modified:
08/03/2011
Description
Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.
Impact
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:citrix:access_essentials:1.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:citrix:access_essentials:1.5:*:*:*:*:*:*:* | ||
cpe:2.3:a:citrix:access_essentials:2.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:citrix:metaframe_presentation_server:3.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:citrix:presentation_server:4.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:citrix:presentation_server:4.5:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://packetstormsecurity.org/0210-exploits/hackingcitrix.txt
- http://secunia.com/advisories/27633
- http://support.citrix.com/article/CTX115245
- http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/
- http://www.securityfocus.com/bid/26451
- http://www.securitytracker.com/id?1018962=
- http://www.vupen.com/english/advisories/2007/3870