CVE-2023-24490
mediumpriority · track · 17EPSS 0.003 · 23 %ileDEEUUSEPSS · scored 2026-10-28
Users with only access to launch VDA applications can launch an unauthorized desktop
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (12)
Products and version ranges known to be affected.
- Citrix Virtual Delivery Agents for Linux for CVAD and Citrix DaaS SecurityCurrent Release (CR) 0 → 2305enisa_euvdEU
- Citrix Virtual Delivery Agents for Linux for CVAD and Citrix DaaS SecurityLong Term Service Release (LTSR) 0 → 1912 LTSR CU7 hotfix 1(19.12.7001)enisa_euvdEU
- Citrix Virtual Delivery Agents for Linux for CVAD and Citrix DaaS SecurityLong Term Service Release (LTSR) 0 → 2203 LTSR CU3enisa_euvdEU
- Citrix Virtual Delivery Agents for Windows for CVAD and Citrix DaaS SecurityCurrent Release (CR) 0 → 2305enisa_euvdEU
- Citrix Virtual Delivery Agents for Windows for CVAD and Citrix DaaS SecurityLong Term Service Release (LTSR) 0 → 1912 LTSR CU7enisa_euvdEU
- Citrix Virtual Delivery Agents for Windows for CVAD and Citrix DaaS SecurityLong Term Service Release (LTSR) 0 → 2203 LTSR CU3enisa_euvdEU
- citrix linux virtual delivery agent< 2305nvdUScpe:2.3:o:citrix:linux_virtual_delivery_agent:*:*:*:*:*:*:*:*
- citrix linux virtual delivery agent= 1912nvdUScpe:2.3:o:citrix:linux_virtual_delivery_agent:*:*:*:*:*:*:*:*
- citrix linux virtual delivery agent= 2203nvdUScpe:2.3:o:citrix:linux_virtual_delivery_agent:*:*:*:*:*:*:*:*
- citrix virtual apps and desktops< 2305nvdUScpe:2.3:a:citrix:virtual_apps_and_desktops:*:*:*:*:*:*:*:*
- citrix virtual apps and desktops= 1912nvdUScpe:2.3:a:citrix:virtual_apps_and_desktops:*:*:*:*:*:*:*:*
- citrix virtual apps and desktops= 2203nvdUScpe:2.3:a:citrix:virtual_apps_and_desktops:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-1459Citrix Systems Virtual Apps and Desktops: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2023-06-13csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Citrix Systems Virtual Apps and Desktops ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-24490/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-24490cnnvd
- https://support.citrix.com/article/CTX559370/windows-and-linux-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve202324490cnnvd
- https://support.citrix.com/article/CTX559370/windows-and-linux-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve202324490enisa_euvd
- https://support.citrix.com/article/CTX559370/windows-and-linux-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve202324490Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan