CVE-2020-13998
Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Published
2020-06-11T02:15:10.713
Last Modified
2024-11-21T05:02:19.037
Status
Modified
Source
[email protected]
Severity
CVSSv3.1: 5.3 (MEDIUM)
CVSSv2 Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
- Access Vector: NETWORK
- Access Complexity: MEDIUM
- Authentication: NONE
- Confidentiality Impact: PARTIAL
- Integrity Impact: NONE
- Availability Impact: NONE
Exploitability Score
8.6
Impact Score
2.9
Weaknesses
-
Type: Primary
CWE-203
-
Type: Secondary
CWE-639
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
citrix
|
xenapp
|
6.5.0.0 |
Yes
|
References