CVE-2024-6151 - OpenCVE

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://support.citrix.com/article/CTX678035

History

No history.

MITRE

Status: PUBLISHED

Assigner: Citrix

Published: 2024-07-10T20:21:25.554Z

Updated: 2024-08-01T21:33:04.965Z

Reserved: 2024-06-18T21:14:34.928Z

Link: CVE-2024-6151

Vulnrichment

Updated: 2024-08-01T21:33:04.965Z

NVD

Status : Awaiting Analysis

Published: 2024-07-10T21:15:11.013

Modified: 2024-08-01T14:00:12.180

Link: CVE-2024-6151

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6151", "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6", "state": "PUBLISHED", "assignerShortName": "Citrix", "dateReserved": "2024-06-18T21:14:34.928Z", "datePublished": "2024-07-10T20:21:25.554Z", "dateUpdated": "2024-08-01T21:33:04.965Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Windows Virtual Delivery Agent", "vendor": "Citrix", "versions": [{"lessThan": "0", "status": "affected", "version": "2402", "versionType": "patch"}, {"lessThan": "CU9", "status": "affected", "version": "1912 LTSR", "versionType": "patch"}, {"lessThan": "CU5", "status": "affected", "version": "2203 LTSR", "versionType": "patch"}]}], "datePublic": "2024-07-09T20:19:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<b><span style=\"background-color: transparent;\">Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges </span></b>in <span style=\"background-color: transparent;\">Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS</span>"}], "value": "Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges\u00a0in\u00a0Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6", "shortName": "Citrix", "dateUpdated": "2024-07-10T20:21:25.554Z"}, "references": [{"url": "https://support.citrix.com/article/CTX678035"}], "source": {"discovery": "UNKNOWN"}, "title": "Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}], "affected": [{"vendor": "citrix", "product": "virtual_apps_and_desktops", "cpes": ["cpe:2.3:a:citrix:virtual_apps_and_desktops:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2402", "versionType": "custom"}, {"version": "1912 LTSR", "status": "affected", "lessThan": "CU9", "versionType": "custom"}, {"version": "2203 LTSR", "status": "affected", "lessThan": "CU5", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-10T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-6151"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T03:55:19.557Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:33:04.965Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.citrix.com/article/CTX678035", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.citrix.com/article/CTX678035", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:33:04.965Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6151", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-12T20:02:35.634261Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:citrix:virtual_apps_and_desktops:*:*:*:*:*:*:*:*"], "vendor": "citrix", "product": "virtual_apps_and_desktops", "versions": [{"status": "affected", "version": "0", "lessThan": "2402", "versionType": "custom"}, {"status": "affected", "version": "1912 LTSR", "lessThan": "CU9", "versionType": "custom"}, {"status": "affected", "version": "2203 LTSR", "lessThan": "CU5", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T20:05:53.242Z"}}], "cna": {"title": "Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Citrix", "product": "Windows Virtual Delivery Agent", "versions": [{"status": "affected", "version": "2402", "lessThan": "0", "versionType": "patch"}, {"status": "affected", "version": "1912 LTSR", "lessThan": "CU9", "versionType": "patch"}, {"status": "affected", "version": "2203 LTSR", "lessThan": "CU5", "versionType": "patch"}], "defaultStatus": "unaffected"}], "datePublic": "2024-07-09T20:19:00.000Z", "references": [{"url": "https://support.citrix.com/article/CTX678035"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges\u00a0in\u00a0Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS", "supportingMedia": [{"type": "text/html", "value": "<b><span style=\"background-color: transparent;\">Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges </span></b>in <span style=\"background-color: transparent;\">Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS</span>", "base64": false}]}], "providerMetadata": {"orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6", "shortName": "Citrix", "dateUpdated": "2024-07-10T20:21:25.554Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6151", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:33:04.965Z", "dateReserved": "2024-06-18T21:14:34.928Z", "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6", "datePublished": "2024-07-10T20:21:25.554Z", "assignerShortName": "Citrix"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges\u00a0in\u00a0Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS"}, {"lang": "es", "value": "La escalada de privilegios locales permite a un usuario con pocos privilegios obtener privilegios de SYSTEM en Virtual Delivery Agent para Windows utilizado por Citrix Virtual Apps and Desktops y Citrix DaaS."}], "id": "CVE-2024-6151", "lastModified": "2024-08-01T14:00:12.180", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "secure@citrix.com", "type": "Secondary"}]}, "published": "2024-07-10T21:15:11.013", "references": [{"source": "secure@citrix.com", "url": "https://support.citrix.com/article/CTX678035"}], "sourceIdentifier": "secure@citrix.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}