This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Citrix fixes 3 vulnerabilities in various products
Citrix fixes 3 vulnerabilities in various products [1][2]. Individual products and their fixed versions: Citrix NetScaler Console - 14.1-38.53, 13.1-56.18 [1] Citrix NetScaler Agent - 14.1-38.53, 13.1-56.18 [1] Citrix Secure Access Client for Mac - 25.01.2 [2]
An adjacent authenticated attacker can perform privilege escalation [1].
The vulnerability is present in products:
- *:NetScaler Console; >=14.1, <14.1-38.53; >=13.1, <13.1-56.18;
- *:NetScaler Agent; >=14.1, <14.1-38.53; >=13.1, <13.1-56.18;
CVSS: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-12284 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 18. 2. 2025.
A local authenticated attacker can elevate their privileges to those with which the vulnerable application runs [2].
The vulnerability is present in product:
- Citrix Secure Access Client for Mac; <25.01.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
More information:
- CVE-2025-1222 at cve.org, NVD
- CVE-2025-1223 at cve.org, NVD
- CWE-693: Protection Mechanism Failure at cwe.mitre.org
- CWE-427: Uncontrolled Search Path Element at cwe.mitre.org
The vulnerability was publicly disclosed 18. 2. 2025.
Links
By CESNET, z.s.p.o. Martin Krajči on 3. 3. 2025.