Type Vulnerability
Citrix Session Recording contains a deserialisation of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access.
Citrix · Parser conflict
Citrix Session Recording Unsafe Deserialisation Vulnerability
CVE-2024-8069
What this means
This is rated medium severity (5.1 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Citrix Session Recording is in your estate.
Full vendor description
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
Scoring and exploitation
5.1/ 10
CVSS 4.0 base scoreMedium
Exploitable from the same local network with a low-privilege account, and no one has to click or open anything. Low impact on confidentiality, integrity and availability.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorAdjacentAV:A
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredLowPR:L
User interactionNoneUI:N
Impact
Longer bar: more harm
ConfidentialityLowVC:L
IntegrityLowVI:L
AvailabilityLowVA:L
- Elevated attack likelihood (~18.2% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Citrix Session Recording
Weaknesses
CWE-502
Affected products ()
- Citrix Session Recording
Show the raw CPE strings (17)
- cpe:2.3:a:citrix:session_recording:*:*:*:*:-:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:-:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu1:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu2:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu3:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu4:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu5:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu6:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu7:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:1912:cu8:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2203:-:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2203:cu1:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2203:cu2:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2203:cu3:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2203:cu4:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2402:-:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:session_recording:2407:-:*:*:-:*:*:*
References
2 links from the CVE record, grouped by site; the vendor's advisory comes first.
support.citrix.com1 linkVendor advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource