Unscored severity · published Mar 26, 2015
CVE-2015-2683
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote…
–
CVSS
5.2%
EPSS
No
On KEV
Description
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Center · Citrix
5.1; 5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2683
Exploit
http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html
seclists.org
http://seclists.org/fulldisclosure/2015/Mar/127
support.citrix.com
http://support.citrix.com/article/CTX200584
www.securityfocus.com
http://www.securityfocus.com/archive/1/534933/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/73313
www.securitytracker.com
http://www.securitytracker.com/id/1031993
More from Command Center
8.1
CVE-2015-7999
Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated…
–
CVE-2015-2682
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml