CVE-2020-13998 — Observable Discrepancy in Citrix Xenapp

CWE-203 — Observable DiscrepancyCWE-639 — Authorization Bypass Through User-Controlled KeyCWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
1.6%
top 18.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Citrix Xenapp
Timeline
PublishedJun 11
Latest updateMay 24

Description

Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDcitrix/xenapp6.5.0.0
▶citrixcitrix/xenapp

🔴Vulnerability Details

1
GHSA
GHSA-5x67-frfj-mmvh: ** VERSION NOT SUPPORTED WHEN ASSIGNED ** Citrix XenApp 6↗2022-05-24
▶

📋Vendor Advisories

1
Citrix
CVE-2020-13998: Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA err↗2020-06-11
▶