CVE-2023-24491

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been discovered in the Citrix Secure Access client for Windows

which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT AUTHORITY\SYSTEM.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-244928.8A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely e CVE-2023-244935.7A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An au CVE-2023-244945.4A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it CVE-2023-244956.5A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. CVE-2023-244964.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244974.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244987.5An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config CVE-2023-244994.6Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spo CVE-2023-24504.4The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version CVE-2023-245006.5Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.CVE-2023-245019.8Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit.CVE-2023-245026.5Electra Central AC unit – The unit opens an AP with an easily calculated password.