CVE-2020-8269 Privilege escalation in Citrix Virtual Apps and Desktops
An unprivileged Windows user can execute arbitrary commands as SYSTEM on Citrix Virtual Apps and Desktops, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8269?
CVE-2020-8269 is a high-severity vulnerability in Citrix Virtual Apps and Desktops, published on 16 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9
Weakness: CWE-269
Which versions are affected by CVE-2020-8269?
It affects 3 products.
Products include Citrix Virtual Apps and Desktops, Citrix Xenapp, Citrix Xendesktop.
How do I fix CVE-2020-8269?
No fix has been published for CVE-2020-8269 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8269 being exploited?
There is no known exploitation of CVE-2020-8269 in the wild and no public exploit code.
Other vulnerabilities in Citrix Virtual Apps and Desktops
- CVE-2020-8283 Privilege escalation in Citrix Virtual Apps and Desktops
- CVE-2020-8270 Command injection in Citrix Virtual Apps and Desktops
- CVE-2024-6151 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2023-24483 Privilege Escalation to NT AUTHORITY\SYSTEM on the vulnerable VDA
- CVE-2021-22928 Privilege escalation in Citrix Virtual Apps and Desktops
Sources
Also known as GHSA-x9cq-5m73-v949.