CVE-2020-13998
First published: Thu Jun 11 2020(Updated: )
** UNSUPPORTED WHEN ASSIGNED ** Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Citrix XenApp | =6.5.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this Citrix XenApp vulnerability?
The vulnerability ID of this Citrix XenApp vulnerability is CVE-2020-13998.
What is the severity of CVE-2020-13998?
The severity of CVE-2020-13998 is medium with a CVSS score of 5.3.
Which software version is affected by CVE-2020-13998?
Citrix XenApp version 6.5.0.0 is affected by CVE-2020-13998.
What does this vulnerability allow an attacker to do?
This vulnerability allows a remote unauthenticated attacker to ascertain whether a user exists on the server by exploiting the 2FA error page.
Is there a fix available for this vulnerability?
Since the affected software is no longer supported, there may not be an official fix available. It is recommended to upgrade to a supported version or consider alternative mitigation strategies.
- collector/nvd-index
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/citrix
- canonical/citrix xenapp
- version/citrix xenapp/6.5.0.0