9.8Critical
KEV
Used in ransomware
CVE-2019-11634Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Known exploited — Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-11634
Description
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
Weakness (CWE):
CWE-284
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin Vendor Advisory
- https://support.citrix.com/article/CTX251986 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11634 US Government Resource
CPE matches (NVD) (2)
cpe:2.3:a:citrix:receiver:4.9:cumulative_update_6:*:*:windows:*:*:*cpe:2.3:a:citrix:workspace:*:*:*:*:*:windows:*:*< 1904