CVE-2015-2683

Citrix Command Center < 5.1 Build 35.4 and 5.2 < Build 42.7 - Remote Code Execution via Advent JMX Servlet

Title source: llm

Description

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic.

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/534933/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/73313

Exploit x_refsource_misc

http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Mar/127

Exploit x_refsource_misc

https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html

Vendor Advisory x_refsource_confirm

http://support.citrix.com/article/CTX200584

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1031993

Scores

EPSS 0.0332

EPSS Percentile 87.4%

Details

CWE

CWE-264

Status published

Products (2)

citrix/command_center 5.1

citrix/command_center 5.2

Published Mar 26, 2015

Tracked Since Feb 18, 2026