{"id": "CVE-2015-2683", "bulletinFamily": "NVD", "title": "CVE-2015-2683", "description": "Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic.", "published": "2015-03-26T14:59:00", "modified": "2018-10-09T19:56:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2683", "reporter": "cve@mitre.org", "references": ["http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html", "http://seclists.org/fulldisclosure/2015/Mar/127", "https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html", "http://www.securityfocus.com/bid/73313", "http://support.citrix.com/article/CTX200584", "http://www.securitytracker.com/id/1031993", "http://www.securityfocus.com/archive/1/534933/100/0/threaded"], "cvelist": ["CVE-2015-2683"], "type": "cve", "lastseen": "2021-02-02T06:21:23", "edition": 4, "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "kaspersky", "idList": ["KLA10522"]}], "modified": "2021-02-02T06:21:23", "rev": 2}, "score": {"value": 8.0, "vector": "NONE", "modified": "2021-02-02T06:21:23", "rev": 2}, "vulnersScore": 8.0}, "cpe": ["cpe:/a:citrix:command_center:5.1", "cpe:/a:citrix:command_center:5.2"], "affectedSoftware": [{"cpeName": "citrix:command_center", "name": "citrix command center", "operator": "eq", "version": "5.1"}, {"cpeName": "citrix:command_center", "name": "citrix command center", "operator": "eq", "version": "5.2"}], "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:citrix:command_center:5.2:*:*:*:*:*:*:*", "cpe:2.3:a:citrix:command_center:5.1:*:*:*:*:*:*:*"], "cwe": ["CWE-264"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:citrix:command_center:5.2:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:citrix:command_center:5.1:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html", "refsource": "MISC", "tags": ["Exploit"], "url": "https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html"}, {"name": "1031993", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id/1031993"}, {"name": "http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html", "refsource": "MISC", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html"}, {"name": "http://support.citrix.com/article/CTX200584", "refsource": "CONFIRM", "tags": [], "url": "http://support.citrix.com/article/CTX200584"}, {"name": "20150319 Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users", "refsource": "BUGTRAQ", "tags": [], "url": "http://www.securityfocus.com/archive/1/534933/100/0/threaded"}, {"name": "20150319 Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users", "refsource": "FULLDISC", "tags": [], "url": "http://seclists.org/fulldisclosure/2015/Mar/127"}, {"name": "73313", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/73313"}], "immutableFields": []}

{"kaspersky": [{"lastseen": "2020-09-02T11:53:40", "bulletinFamily": "info", "cvelist": ["CVE-2015-2683", "CVE-2015-2682"], "description": "### *Detect date*:\n03/26/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Citrix Controle Center. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information.\n\n### *Affected products*:\nCitrix Command Center 5.1 versions earlier than Build 35.4 \nCitrix Command Center 5.2 versions earlier than Build 42.7\n\n### *Solution*:\nUpdate to the latest version\n\n### *Original advisories*:\n[Citrix bulletin](<http://support.citrix.com/article/CTX200584>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Citrix Command Center](<https://threats.kaspersky.com/en/product/Citrix-Command-Center/>)\n\n### *CVE-IDS*:\n[CVE-2015-2683](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2683>)7.5Critical \n[CVE-2015-2682](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2682>)5.0Critical\n\n### *Exploitation*:\nThe following public exploits exists for this vulnerability:", "edition": 41, "modified": "2020-06-18T00:00:00", "published": "2015-03-26T00:00:00", "id": "KLA10522", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10522", "title": "\r KLA10522Multiple vulnerabilities in Citrix CC ", "type": "kaspersky", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}