Command injection

2020-11-1601:15:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.6%

JSON

An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9

CPENameOperatorVersion
virtual_apps_and_desktopsge1903
virtual_apps_and_desktopsle1912
virtual_apps_and_desktopsle2006
xenappeq7.6 cu8
xenappeq7.6
xenapplt7.6
xenappeq7.15 cu6
xenappeq7.15
xenappge7.7
xenapplt7.15

Name	Operator	Version
virtual_apps_and_desktops	ge	1903
virtual_apps_and_desktops	le	1912
virtual_apps_and_desktops	le	2006
xenapp	eq	7.6 cu8
xenapp	eq	7.6
xenapp	lt	7.6
xenapp	eq	7.15 cu6
xenapp	eq	7.15
xenapp	ge	7.7
xenapp	lt	7.15