CVE-2023-24490: Users with only access to launch VDA applications can launch an unauthorized desktop

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-10 · updated 2026-06-17
Weakness: CWE-284

Description

Users with only access to launch VDA applications can launch an unauthorized desktop

Affected products

Citrix Linux Virtual Delivery Agent: before 2305; 1912-cu1, 1912-cu2, 1912-cu3, 1912-cu4, 1912-cu5, 1912-cu6 (+2); 1912, 2203 — fixed in 2305
Citrix Virtual Apps and Desktops: before 2305; 1912-cu1, 1912-cu2, 1912-cu3, 1912-cu4, 1912-cu5, 1912-cu6 (+2); 1912, 2203 — fixed in 2305
Citrix Virtual Delivery Agents for Linux for CVAD and Citrix DaaS Security: from Current Release (CR) 0 before 2305; from Long Term Service Release (LTSR) 0 before 2203 LTSR CU3; from Long Term Service Release (LTSR) 0 before 1912 LTSR CU7 hotfix 1(19.12.7001) — fixed in 2305, 2203 LTSR CU3, 1912 LTSR CU7 hotfix 1(19.12.7001)
Citrix Virtual Delivery Agents for Windows for CVAD and Citrix DaaS Security: from Current Release (CR) 0 before 2305; from Long Term Service Release (LTSR) 0 before 2203 LTSR CU3; from Long Term Service Release (LTSR) 0 before 1912 LTSR CU7 — fixed in 2305, 2203 LTSR CU3, 1912 LTSR CU7

How to fix

Upgrade to a fixed version: Citrix Linux Virtual Delivery Agent 2305; Citrix Virtual Apps and Desktops 2305; Citrix Virtual Delivery Agents for Linux for CVAD and Citrix DaaS Security 2305, 2203 LTSR CU3, 1912 LTSR CU7 hotfix 1(19.12.7001); Citrix Virtual Delivery Agents for Windows for CVAD and Citrix DaaS Security 2305, 2203 LTSR CU3, 1912 LTSR CU7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24490 or the next vulnerability affects your stack