CVE-2013-2934 Missing authorization in n/a

Critical 10.0 Published 12 Sep 2013 Updated 16 Sep 2024

Improper access restrictions in Citrix CloudPortal Services Manager allow attackers to bypass security controls on web services.

Exploited in the wild: Not known
Login needed: Not stated
Attackable: Over the internet
Victim action needed: Not stated
Fix: None listed

What is CVE-2013-2934?

CVE-2013-2934 is a critical missing authorization vulnerability in n/a, published on 12 Sep 2013. It can be exploited over the network.

Official description

Citrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 does not properly restrict access to web services, which has unspecified impact and attack vectors, a different vulnerability than other CVEs listed in CTX137162.

Weakness: CWE-264

Which versions are affected by CVE-2013-2934?

It affects 1 product.

Products include Citrix Cloudportal Services Manager.

How do I fix CVE-2013-2934?

No fix has been published for CVE-2013-2934 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2013-2934 being exploited?

There is no known exploitation of CVE-2013-2934 in the wild and no public exploit code.

Sources

Also known as GHSA-7vff-qw8c-gfw5.