CVE-2015-2682 : Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows rem

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.

Published 2015-03-26 14:59:02

Updated 2019-02-05 18:15:00

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-2682

Citrix » Command Center » Version: 5.2
cpe:2.3:a:citrix:command_center:5.2:*:*:*:*:*:*:*
Matching versions
Citrix » Command Center » Version: 5.1
cpe:2.3:a:citrix:command_center:5.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-2682

EPSS FAQ

7.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 94 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-2682

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2015-2682

CWE-17

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-2682

http://seclists.org/fulldisclosure/2015/Mar/126

Full Disclosure: Citrix Command Center allows downloading of configuration files
Mailing List;Third Party Advisory
https://www.securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html

Citrix Command Center allows downloading of configuration files - Security Advisories and Insights - Securify B.V.
Exploit
http://support.citrix.com/article/CTX200584

Vulnerabilities in Citrix Command Center Could Result in Credential Disclosure and Host Compromise
Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/36441/

Citrix Command Center - Credential Disclosure
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/73309

Citrix Command Center CVE-2015-2682 Arbitrary File Download Vulnerabilitiy
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html

Citrix Command Center Configuration Disclosure ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1031993

Citrix Command Center Bugs Let Remote Users Download Files and Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2015-2682

Products affected by CVE-2015-2682

Exploit prediction scoring system (EPSS) score for CVE-2015-2682

CVSS scores for CVE-2015-2682

CWE ids for CVE-2015-2682

References for CVE-2015-2682