VMware Horizon VDA Exploit: Unauthorized Desktop Launch
CVE-2023-24490 Published on July 10, 2023

Users with only access to launch VDA applications can launch an unauthorized desktop
Users with only access to launch VDA applications can launch an unauthorized desktop

NVD

Vulnerability Analysis

CVE-2023-24490 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

LOW

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2023-24490 has been classified to as an Authorization vulnerability or weakness.

Products Associated with CVE-2023-24490

stack.watch emails you whenever new vulnerabilities are published in Citrix Virtual Apps And Desktops or Citrix Linux Virtual Delivery Agent. Just hit a watch button to start following.

Citrix Virtual Apps And Desktops

Citrix Linux Virtual Delivery Agent

Affected Versions

Virtual Delivery Agents for Windows for CVAD and Citrix DaaS Security:

Version Current Release (CR) 0 and below 2305 is affected.
Version Long Term Service Release (LTSR) 0 and below 2203 LTSR CU3 is affected.
Version Long Term Service Release (LTSR) 0 and below 1912 LTSR CU7 is affected.

Virtual Delivery Agents for Linux for CVAD and Citrix DaaS Security:

Version Current Release (CR) 0 and below 2305 is affected.
Version Long Term Service Release (LTSR) 0 and below 2203 LTSR CU3 is affected.
Version Long Term Service Release (LTSR) 0 and below 1912 LTSR CU7 hotfix 1(19.12.7001) is affected.

Exploit Probability

EPSS

0.06%

Percentile

17.27%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.