Citrix Releases Security Updates for Multiple Products

Scheduled updates for Citrix SD-WAN products, StoreFront, Endpoint Management (XenMobile Server), and Gateway Plug-in for Windows

Threat ID:: CC-4076
Threat Severity:: Information only
Published:: 14 April 2022 2:17 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for Citrix SD-WAN products, StoreFront, Endpoint Management (XenMobile Server), and Gateway Plug-in for Windows

Affected platforms

The following platforms are known to be affected:

Citrix SD-WAN

Citrix Virtual Apps and Desktops

Citrix StoreFront

Citrix XenMobile Server

Citrix ADC

Citrix Gateway

Threat details

Introduction

Citrix has released security updates to address vulnerabilities in multiple products. An attacker could exploit these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review the following security advisories and apply the relevant hotfixes or workarounds.

Remediation steps

Type	Step
Patch	CTX370550 \| Citrix SD-WAN Security Bulletin for CVE-2022-27505 and CVE-2022-27506 Affecting: Citrix SD-WAN https://support.citrix.com/article/CTX370550
Patch	CTX377814 \| Citrix StoreFront Security Bulletin for CVE-2022-27503 Affecting: Citrix Virtual Apps and Desktops StoreFront https://support.citrix.com/article/CTX377814
Patch	CTX370551 \| Citrix Endpoint Management (XenMobile Server) Security Bulletin for CVE-2021-44519, CVE-2021-44520, and CVE-2022-26151 Affecting: XenMobile https://support.citrix.com/article/CTX370551
Patch	CTX341455 \| Citrix Gateway Plug-in for Windows Security Bulletin for CVE-2022-21827 Affecting: Citrix ADC Citrix Gateway https://support.citrix.com/article/CTX341455

Definitive source of threat updates

https://www.cisa.gov/uscert/ncas/current-activity/2022/04/12/citrix-releases-security-updates-multiple-products

CVE Vulnerabilities

Status Published

CVE-2022-27503

Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9

Status Published

CVE-2022-27505

Reflected cross site scripting (XSS)

Status Published

CVE-2022-27506

Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI

Status Reserved

CVE-2021-44519

Status Published

CVE-2021-44520

In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.

Status Reserved

CVE-2022-21827

Status Published

CVE-2022-26151

Citrix XenMobile Server 10.12 through RP11, 10.13 through RP6, and 10.14 through RP4 allows Command Injection.

Last edited: 14 April 2022 2:44 pm