CVE-2024-8069

Summary

Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server

Affected Software

VendorProductVersion RangeStatus
Citrix Session RecordingCitrix Session Recording2407 Current Release < 24.5.200.8affected
Citrix Session RecordingCitrix Session Recording1912 LTSR < CU9 hotfix 19.12.9100.6affected
Citrix Session RecordingCitrix Session Recording2203 LTSR < CU5 hotfix 22.03.5100.11affected
Citrix Session RecordingCitrix Session Recording2402 LTSR < CU1 hotfix 24.02.1200.16affected

Weaknesses

  • CWE-502: CWE-502 Deserialization of Untrusted Data

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: active
    • Automatable: no
    • Technical Impact: total

Additional References

References