Unscored severity · published Dec 31, 2002
CVE-2002-2426
Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote…
–
CVSS
0.7%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Access Essentials · Citrix
1.0; 1.5; 2.0 · source: NVD
MP
Metaframe Presentation Server · Citrix
3.0 · source: NVD
PS
Presentation Server · Citrix
4.0; 4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-2426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-2426
packetstormsecurity.org
http://packetstormsecurity.org/0210-exploits/hackingcitrix.txt
Vendor Advisory
http://secunia.com/advisories/27633
support.citrix.com
http://support.citrix.com/article/CTX115245
www.gnucitizen.org
http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/
www.securityfocus.com
http://www.securityfocus.com/bid/26451
www.securitytracker.com
http://www.securitytracker.com/id?1018962
More from Access Essentials
–
CVE-2008-4676
Unspecified vulnerability in Citrix XenApp (formerly Presentation Server) 4.5 Feature Pack 1 and earlier, Presentation Server 4.0, and Access Essentials 1.0, 1.5, and 2.0 allows…
–
CVE-2008-2299
Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause…
–
CVE-2008-2300
Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users…
–
CVE-2008-0356
Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and…
–
CVE-2007-2850
The Session Reliability Service (XTE) in Citrix MetaFrame Presentation Server 3.0, Presentation Server 4.0, and Access Essentials 1.0 and 1.5, allows remote attackers to bypass…