Citrix Workspace app for Windows LPE Vulnerabilities Security Bulletin (CVE-2024-7889/7890)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Description: - Title: Citrix Workspace app for Windows Security Bulletin CVE-2024-7889 and CVE-2024-7890 - Issue Description: Two vulnerabilities affecting Citrix Workspace app for Windows have been identified. - Affected Versions: - Current Release (CR): Citrix Workspace app for Windows versions BEFORE 2405 - Long-Term Service Release (LTSR): Citrix Workspace app for Windows versions BEFORE 2402 LTSR CU1 2. Vulnerability Details: - CVE-2024-7889: - Description: Local privilege escalation allowing low-privileged users to gain SYSTEM privileges. - Prerequisites: Local access to the target system. - CWE: CWE-664: Improper Control of a Resource Through its Lifetime - CVSS v4.0 Base Score: 7.0 - CVE-2024-7890: - Description: Local privilege escalation allowing low-privileged users to gain SYSTEM privileges. - Prerequisites: Local access to the target system. - CWE: CWE-269: Improper Privilege Management - CVSS v4.0 Base Score: 5.4 3. Solution: - Citrix strongly recommends customers upgrade Citrix Workspace app for Windows to a version that includes the fixes as soon as possible. 4. Fixed Versions: - Current Release (CR): Citrix Workspace app for Windows 2405 and later versions - Long-Term Service Release (LTSR): Citrix Workspace app for Windows 2402 CU1 LTSR and later versions 5. Contact Technical Support: - For technical support, please contact Citrix Technical Support. 6. Subscribe to Security Alerts: - Citrix strongly recommends all customers subscribe to security alerts. 7. Report Security Vulnerabilities: - Citrix welcomes security input regarding its products and takes all potential vulnerabilities seriously. For details on how to report security-related issues to Citrix, please refer to the following webpage: https://www.citrix.com/about/trust-center/vulnerability-process.html 8. Disclaimer: - Information is provided “as is” and “as available”. - Information may not be applicable to your system. - Cloud Software Group, Inc. and its subsidiaries (collectively referred to as “Cloud SG”) do not guarantee the accuracy or completeness of the information. - Cloud SG is not liable for any use or misuse of the information. 9. Update Log: - 2024-09-10: Initial release - 2024-09-10: Replaced CR 2405.10 with CR 2405 for clarification.

Goal Reached Thanks to every supporter — we hit 100%!

Citrix Workspace app for Windows LPE Vulnerabilities Security Bulletin (CVE-2024-7889/7890)