CVE-2019-11634KEV · OVERDUECWE-284broken-access-control

Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

Critical · published May 22, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 94.8th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
9.8
EPSS
8%
Percentile
94.8
In the wild
Confirmed
What it is

🚨 A simple oversight in access control could let anyone waltz into your Citrix Workspace App, and it's a critical issue! 🔥 Think of it as a hotel that forgot to lock the back entrance — anyone could stroll in and access the guest rooms without a keycard. This flaw allows unauthorized users to bypass crucial security checks, like slipping through a door that should've been locked tight. An attacker could gain full access to sensitive information and resources within your Citrix environment, leading to absolutely devastating consequences. They could manipulate data, escalate privileges, or even compromise the entire system. With a CVSS score of 9.8, this is not something to take lightly!

Put simply

Think of it as a hotel that forgot to lock the back entrance — anyone could stroll in and access the guest rooms without a keycard. This flaw allows unauthorized users to bypass crucial security checks, like slipping through a door that should've been locked tight. CVE-2019-11634 stems from incorrect access control in Citrix Workspace App before version 1904 for Windows, allowing unauthorized users to bypass security protocols and access restricted functionalities.

What to do

An attacker could gain full access to sensitive information and resources within your Citrix environment, leading to absolutely devastating consequences. They could manipulate data, escalate privileges, or even compromise the entire system. With a CVSS score of 9.8, this is not something to take lightly! Patch your Citrix Workspace App immediately to version 1904 or later to close this vulnerability. Audit your configurations to ensure proper access controls are in place. Regularly review your security policies to prevent similar issues in the future. You've got this! Take action now, and you'll be a security hero in no time! 🦸

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08091 · 94.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2019-05-22T21:29Z
KEV added
2021-11-03 · due 2022-05-03
Affected products (2)
ProductVersionsFixed in
citrix/receiverall versions—
citrix/workspace< 19041904
References (5)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 22 MAY 16:46Z
    Citrix Workspace App before 1904 for Windows has Incorrect Access Control
    cvelistv5