CVE-2015-2683

{"id": "CVE-2015-2683", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-03-26T14:59:02.663", "references": [{"url": "http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2015/Mar/127", "source": "cve@mitre.org"}, {"url": "http://support.citrix.com/article/CTX200584", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/534933/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/73313", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1031993", "source": "cve@mitre.org"}, {"url": "https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic."}, {"lang": "es", "value": "Citrix Command Center anterior a 5.1 Build 35.4 y 5.2 anterior a Build 42.7 no restringe correctamente el acceso al servlet Advent Java Management Extensions (JMX), lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores no especificados en servlets/Jmx_dynamic."}], "lastModified": "2018-10-09T19:56:18.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:citrix:command_center:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DD0B52F-610D-4281-B086-3626E1803418"}, {"criteria": "cpe:2.3:a:citrix:command_center:5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "360C1C8C-B4CF-4E16-A6C2-1F63A53B3233"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}