Citrix StoreFront Security Bulletin for CVE-2022-27503
Article ID: CTX377814
Updated On:
Description
A reflected cross-site scripting (XSS) issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifier:
|
CVE-ID |
Description |
Type |
Pre-requisites |
|
CVE-2022-27503 |
Reflected Cross Site Scripting (XSS) |
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
A victim user must have a current session on a StoreFront that has been configured to use SAML authentication |
The issue affects the following supported versions of Citrix StoreFront:
- Citrix StoreFront 1912 LTSR up to and including CU4 (1912.0.4000)
- Citrix StoreFront 3.12 for 7.15 LTSR up to and including CU8 (3.12.8000)
Affected versions of Citrix Storefront are included within the following supported versions of Citrix Virtual Apps and Desktops:
- Current Release (CR) versions of Citrix Virtual Apps and Desktops up to and including 2112
- Citrix Virtual Apps and Desktops 1912 LTSR up to and including CU4
- Citrix XenApp & XenDesktop 7.15 LTSR up to and including CU8
Mitigating Factors
This issue only exists when Citrix StoreFront is configured to use SAML authentication. StoreFront deployments that have not been configured to use SAML authentication are unaffected.Instructions
Citrix recommends that affected customers upgrade to a fixed version as their patching schedule allows.
The issue has been addressed in the following supported Citrix StoreFront versions:
- Citrix StoreFront 2203 LTSR (2203.0.0) and later versions
- Citrix StoreFront 1912 LTSR CU5 (1912.0.5000) and later cumulative updates for 1912 LTSR
The latest versions of Citrix StoreFront can be downloaded from the following location:
https://www.citrix.com/downloads/storefront/
These versions of Citrix StoreFront are included within the following supported versions of Citrix Virtual Apps and Desktops:
- Citrix Virtual Apps and Desktops 2203 LTSR and later versions
- Citrix Virtual Apps and Desktops 1912 LTSR CU5 and later cumulative updates for 1912 LTSR
The latest versions of Citrix Virtual Apps and Desktops can be downloaded from the following location:
https://www.citrix.com/downloads/citrix-virtual-apps-and-desktops/
A hotfix has been released to address this issue for Citrix StoreFront 3.12 for 7.15 LTSR.
The hotfix for Citrix StoreFront 3.12 for 7.15 LTSR is available at the following location:
https://support.citrix.com/article/CTX446966
Acknowledgements
Citrix would like to thank Michał Brzezicki and Paweł Żurek for working with us to protect Citrix customers.Additional Information
| Date | Change |
| 2022-04-12 | Initial Publication |
