Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-2683

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic.

Published

2015-03-26T14:59:02.663

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	citrix	command_center	5.1	Yes
Application	citrix	command_center	5.2	Yes

References

http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html Exploit ([email protected])
http://seclists.org/fulldisclosure/2015/Mar/127 ([email protected])
http://support.citrix.com/article/CTX200584 ([email protected])
http://www.securityfocus.com/archive/1/534933/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/73313 ([email protected])
http://www.securitytracker.com/id/1031993 ([email protected])
https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html Exploit ([email protected])
http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2015/Mar/127 (af854a3a-2127-422b-91ae-364da2661108)
http://support.citrix.com/article/CTX200584 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/534933/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/73313 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1031993 (af854a3a-2127-422b-91ae-364da2661108)
https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html Exploit (af854a3a-2127-422b-91ae-364da2661108)