CVE-2007-0011: Infoleak
The web portal interface in Citrix Access Gateway (aka Citrix Advanced Access Control) before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or browser cache.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0011?
CVE-2007-0011 is classified as a medium severity vulnerability due to the potential for session hijacking.
How do I fix CVE-2007-0011?
To mitigate CVE-2007-0011, upgrade to Citrix Access Gateway version 4.5 HF1 or later.
What types of software are affected by CVE-2007-0011?
CVE-2007-0011 affects Citrix Access Gateway versions 4.0, 4.2, and 4.5 Standard and Advanced Editions.
What is the main risk associated with CVE-2007-0011?
The main risk of CVE-2007-0011 is that attackers can hijack user sessions through exposed session IDs in URLs.
Can CVE-2007-0011 impact all users of affected Citrix products?
Yes, any user accessing the affected Citrix Access Gateway versions may be vulnerable to session hijacking.