CVE-2020-8283 Privilege escalation in Citrix Virtual Apps and Desktops
An authorized user can execute arbitrary commands as SYSTEM on Windows hosts running Citrix Universal Print Server, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8283?
CVE-2020-8283 is a high-severity vulnerability in Citrix Virtual Apps and Desktops, published on 14 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9.
Weakness: CWE-269
Which versions are affected by CVE-2020-8283?
It affects 3 products.
Products include Citrix Virtual Apps and Desktops, Citrix Xenapp, Citrix Xendesktop.
How do I fix CVE-2020-8283?
No fix has been published for CVE-2020-8283 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8283 being exploited?
There is no known exploitation of CVE-2020-8283 in the wild and no public exploit code.
Other vulnerabilities in Citrix Virtual Apps and Desktops
- CVE-2020-8269 Privilege escalation in Citrix Virtual Apps and Desktops
- CVE-2020-8270 Command injection in Citrix Virtual Apps and Desktops
- CVE-2024-6151 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2023-24483 Privilege Escalation to NT AUTHORITY\SYSTEM on the vulnerable VDA
- CVE-2021-22928 Privilege escalation in Citrix Virtual Apps and Desktops
Sources
Also known as GHSA-9x7w-7fh3-wph9.