Citrix uberAgent 7.1.2 fixes a serious vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Citrix uberAgent 7.1.2 fixes a serious vulnerability

Citrix uberAgent 7.1.2 fixes a serious vulnerability. If an immediate update cannot be performed, the company recommends disabling all CitrixADC metrics by removing specific timer properties and changing the WmiProvider setting from PowerShell to WMIC [1].

Citrix uberAgent - privilege escalation (CVE-2024-3902)

CVSS 7.3 (High)

An authenticated local attacker can elevate their privileges on the system. The vulnerability arises in certain configurations where uberAgent is set up with specific CitrixADC metrics and the WmiProvider tool set to "PowerShell", together with the configuration of at least one CitrixSession metric [1].

The vulnerability is present in product:

Citrix uberAgent; <7.1.2

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

More information:

CVE-2024-3902 at cve.org, NVD
CWE-269 at cwe.mitre.org

The vulnerability was publicly disclosed 18. 4. 2024.

Report feedback

[TLP:CLEAR] Citrix uberAgent 7.1.2 fixes a serious vulnerability

Citrix uberAgent - privilege escalation (CVE-2024-3902)

CVSS 7.3 (High)

Links