CVE-2023-24486

🗓️ 10 Jul 2023 20:36:01Reported by CitrixType

cve🔗 web.nvd.nist.gov👁 1919 Views🌐 WEB

Vulnerability in Citrix Workspace app for Linux allows local user to gain access to other user's sessio

Reporter	Title	Published	Views	Family All 17
GithubExploit	MCATester	24 Jun 202605:32	–	githubexploit
BDU FSTEC	The vulnerability of the Citrix Workspace App for Linux operating system, related to access control deficiencies, allows a intruder to gain access to user sessions.	3 Aug 202300:00	–	bdu_fstec
Circl	CVE-2023-24486	11 Jul 202300:24	–	circl
CISA	Citrix Releases Security Updates for Workspace Apps, Virtual Apps and Desktops	14 Feb 202300:00	–	cisa
Tenable Nessus	Citrix Workspace App for Linux Privilege Escalation (CTX477618)	17 Feb 202300:00	–	nessus
CNNVD	Citrix Systems Workspace App 安全漏洞	10 Jul 202300:00	–	cnnvd
Citrix	Citrix Workspace app for Linux Security Bulletin for CVE-2023-24486	14 Feb 202316:00	–	citrix
Citrix	CVAD Workspace App (Windows, MAC, Linux)	14 Jul 202400:00	–	citrix
Cvelist	CVE-2023-24486 Local user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applications	10 Jul 202320:36	–	cvelist
EUVD	EUVD-2023-28504	3 Oct 202520:07	–	euvd

NVD

Node

citrix workspaceRange<2302linux

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Citrix Workspace app for Linux",
    "vendor": "Citrix",
    "versions": [
      {
        "lessThan": "2302",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
support	www.support.citrix.com/article/CTX477618/citrix-workspace-app-for-linux-security-bulletin-for-cve202324486

Parameter	Position	Path	Description	CWE
q	query param	demo.testfire.net/search.jsp	SQL Injection via search.jsp with time-based sleep payload	CWE-89
q	query param	demo.testfire.net/search.jsp	Reflected XSS on search.jsp via unescaped payload in query parameter	CWE-79
path	query param	pminternship.mca.gov.in/mca-api/files/get-file-by-path	Unauthenticated file access API allowing retrieval of arbitrary files	CWE-284

17 Jun 2026 05:39Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.5

EPSS0.00185

SSVC

CWE-284