CVE-2015-2682

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-03-26 · updated 2026-06-17
Weakness: CWE-17

Description

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.

Affected products

Citrix Command Center: 5.1, 5.2 (and their updates)

References

http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html
http://seclists.org/fulldisclosure/2015/Mar/126
http://support.citrix.com/article/CTX200584
http://www.securityfocus.com/bid/73309
http://www.securitytracker.com/id/1031993
https://www.exploit-db.com/exploits/36441/
https://www.securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html
http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html
http://seclists.org/fulldisclosure/2015/Mar/126
http://support.citrix.com/article/CTX200584
http://www.securityfocus.com/bid/73309
http://www.securitytracker.com/id/1031993

Get alerted when CVE-2015-2682 or the next vulnerability affects your stack