CVE-2023-24484: A malicious user can cause log files to be written to a directory that they do not have permission to write to.

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-16 · updated 2026-06-17
Weakness: CWE-284

Description

A malicious user can cause log files to be written to a directory that they do not have permission to write to.

Affected products

Citrix Workspace app for Windows: before 2212; 1912-cu1, 1912-cu1-hf1, 1912-cu2, 1912-cu3, 1912-cu4, 1912-cu5 (+2); 1912, 2203.1 — fixed in 2212
Citrix Workspace app for Windows: from Citrix Workspace App versions before 2212 — fixed in 2212, 1912 LTSR before CU7 Hotfix 2 (19.12.7002), 2203 LTSR before CU2

How to fix

Upgrade to a fixed version: Citrix Workspace app for Windows 2212; Citrix Workspace app for Windows 2212, 1912 LTSR before CU7 Hotfix 2 (19.12.7002), 2203 LTSR before CU2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24484 or the next vulnerability affects your stack