Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2008-6830

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
08/06/2009
Last modified:
09/04/2025

Description

The disconnection feature in Citrix Web Interface 5.0 and 5.0.1 for Java Application Servers does not properly terminate a user's web interface session, which allows attackers with access to the same browser instance to gain access to the user's Web Interface session. NOTE: the attacker must also have valid credentials to the Web Interface.

Impact

Vector 2.0
AV:N/AC:H/Au:N/C:P/I:N/A:P CVSS v2.0 Severity and Metrics:

Base Score: 4.00 MEDIUM
Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P

Attack Vector (AV): Network
Attack Complexity (AC): High
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): None
Availability (A): Physical

Base Score 2.0
4.00
Severity 2.0
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:citrix:web_interface:5.0:*:java_application_server:*:*:*:*:*
cpe:2.3:a:citrix:web_interface:5.0.1:*:java_application_server:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools