CVE-2002-2426: CSRF
First published: Tue Dec 31 2002(Updated: )
Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Citrix Access Essentials | =1.0 | |
| Citrix MetaFrame Presentation Server | =3.0 | |
| Citrix Access Essentials | =2.0 | |
| Citrix Presentation Server | =4.0 | |
| Citrix Presentation Server | =4.5 | |
| Citrix Access Essentials | =1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.org/0210-exploits/hackingcitrix.txt
- http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/
- http://support.citrix.com/article/CTX115245
- http://www.securityfocus.com/bid/26451
- http://www.securitytracker.com/id?1018962
- http://secunia.com/advisories/27633
- http://www.vupen.com/english/advisories/2007/3870
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/citrix
- canonical/citrix access essentials
- version/citrix access essentials/1.0
- canonical/citrix metaframe presentation server
- version/citrix metaframe presentation server/3.0
- version/citrix access essentials/2.0
- canonical/citrix presentation server
- version/citrix presentation server/4.0
- version/citrix presentation server/4.5
- version/citrix access essentials/1.5