What is CVE-2020-8270?

CVE-2020-8270 is a high-severity vulnerability in Citrix Virtual_apps_and_desktops, classified under OS Command Injection. CVSS score: 8.8/10. Published 2020-11-16.

How severe is CVE-2020-8270?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Citrix Virtual_apps_and_desktops

CVE-2020-8270

An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Citrix Virtual_apps_and_desktops
N/a Citrix Virtual Apps And Desktops — versions 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

support@hackerone.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-8270?: CVE-2020-8270 is a high-severity vulnerability in Citrix Virtual_apps_and_desktops, classified under OS Command Injection. CVSS score: 8.8/10. Published 2020-11-16.
How severe is CVE-2020-8270?: High severity. CVSS v3 base score is 8.8 out of 10.