Vulnerability in Citrix Federated Authentication Service
CVE-2022-26355
Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (6.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Citrix Federated Authentication Service
- Citrix Federated Authentication Service (Fas) — versions unspecified, 7.17
Weakness classification (CWE)
References
- support.citrix.com/article/CTX341587 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-26355?
- CVE-2022-26355 is a medium-severity vulnerability in Citrix Federated Authentication Service, classified under Exposure of Resource to Wrong Sphere. CVSS score: 4.4/10. Published 2022-03-10.
- How severe is CVE-2022-26355?
- Medium severity. CVSS v3 base score is 4.4 out of 10.