6.9 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
8.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
32.6%
Several issues have been identified within Citrix Hypervisor, which could, if exploited, allow:
These vulnerabilities affect all currently supported versions of Citrix Hypervisor up to and including Citrix Hypervisor 8.1.
These issues have the following identifiers:
Note that support for PV guests was removed in Citrix Hypervisor 8.1. The provided hotfix for Citrix Hypervisor 8.1 does address both issues but customers should not assume that Citrix will address any future security issues related to PV guests running on Citrix Hypervisor 8.1.
Hotfixes have been released to address these issues. Citrix recommends that affected customers install these hotfixes as their patching schedule allows. The hotfixes can be downloaded from the following locations:
Citrix Hypervisor 8.1: CTX270795 – <https://support.citrix.com/article/CTX270795>
Citrix Hypervisor 8.0: CTX270794 – <https://support.citrix.com/article/CTX270794>
Citrix XenServer 7.1 LTSR CU2: CTX270793 – <https://support.citrix.com/article/CTX270793>
Citrix XenServer 7.0: CTX270792 – <https://support.citrix.com/article/CTX270792>
Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at _ <http://support.citrix.com/>_.
If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at _ <https://www.citrix.com/support/open-a-support-case.html>_.
Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the following document: CTX081743 – Reporting Security Issues to Citrix
Date | Change |
---|---|
2020-04-14 | Initial Publication |
CPE | Name | Operator | Version |
---|---|---|---|
citrix hypervisor | le | 8.1 | |
citrix hypervisor | le | 8.0 | |
citrix xenserver | le | 7.1 | |
citrix xenserver | le | 7.0 |
6.9 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
8.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
32.6%