CVE-2009-3936

2009-11-1316:30:00

CWE-310

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

AI Score

6.1

Confidence

Low

EPSS

0.004

Percentile

72.8%

JSON

Unspecified vulnerability in Citrix Online Plug-in for Windows 11.0.x before 11.0.150 and 11.x before 11.2, Online Plug-in for Mac before 11.0, Receiver for iPhone before 1.0.3, and ICA Java, Mac, UNIX, and Windows Clients for XenApp and XenDesktop allows remote attackers to impersonate the SSL/TLS server and bypass authentication via a crafted certificate, a different vulnerability than CVE-2009-3555.

Affected configurations

Nvd

Node

citrixonline_plug-in_for_macRange≤10.0

citrixonline_plug-in_for_windowsRange≤11.2

citrixonline_plug-in_for_windowsMatch11.0

citrixonline_plug-in_for_windowsMatch11.1

citrixreceiver_for_iphoneRange≤1.0

VendorProductVersionCPE
citrixonline_plug-in_for_mac*cpe:2.3:a:citrix:online_plug-in_for_mac:*:*:*:*:*:*:*:*
citrixonline_plug-in_for_windows*cpe:2.3:a:citrix:online_plug-in_for_windows:*:*:*:*:*:*:*:*
citrixonline_plug-in_for_windows11.0cpe:2.3:a:citrix:online_plug-in_for_windows:11.0:*:*:*:*:*:*:*
citrixonline_plug-in_for_windows11.1cpe:2.3:a:citrix:online_plug-in_for_windows:11.1:*:*:*:*:*:*:*
citrixreceiver_for_iphone*cpe:2.3:a:citrix:receiver_for_iphone:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
citrix	online_plug-in_for_mac	*	cpe:2.3:a:citrix:online_plug-in_for_mac::::::::
citrix	online_plug-in_for_windows	*	cpe:2.3:a:citrix:online_plug-in_for_windows::::::::
citrix	online_plug-in_for_windows	11.0	cpe:2.3:a:citrix:online_plug-in_for_windows:11.0:::::::*
citrix	online_plug-in_for_windows	11.1	cpe:2.3:a:citrix:online_plug-in_for_windows:11.1:::::::*
citrix	receiver_for_iphone	*	cpe:2.3:a:citrix:receiver_for_iphone::::::::