SB2024071062 - Multiple vulnerabilities in Citrix Workspace app for HTML5

Security Bulletin ID SB2024071062

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect default permissions (CVE-ID: CVE-2024-6148)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A remote user can bypass GACS Policy Configuration settings.

2) Open redirect (CVE-ID: CVE-2024-6149)

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote user can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Remediation

Install update from vendor's website.

References

https://support.citrix.com/article/CTX678037/citrix-workspace-app-for-html5-security-bulletin-cve20246148-and-cve20246149