Read the docs
TI-2024-05699 Aliases CVE-2024-6150GHSA-j94j-pqhq-qr6h

A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning

Priority LOW 22CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Fix Fixed Citrix Provisioning (Citrix): 0, CU5, CU9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CitrixCitrix Provisioning2402 to before 0; 22.3 LTSR to before CU5; 1912 LTSR to before CU90, CU5, CU9Patch availableCNA
  • Citrix Provisioning VendorCitrix Affected 2402 to before 0; 22.3 LTSR to before CU5; 1912 LTSR to before CU9 Fixed in 0, CU5, CU9 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:citrix:provisioning:*:*:*:*:-:*:*:*up to 2311VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu1:*:*:ltsr:*:*:*1912 cu1VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu2:*:*:ltsr:*:*:*1912 cu2VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu3:*:*:ltsr:*:*:*1912 cu3VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu4:*:*:ltsr:*:*:*1912 cu4VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu5:*:*:ltsr:*:*:*1912 cu5VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu6:*:*:ltsr:*:*:*1912 cu6VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu7:*:*:ltsr:*:*:*1912 cu7VulnerableCitrix
cpe:2.3:a:citrix:provisioning:1912:cu8:*:*:ltsr:*:*:*1912 cu8VulnerableCitrix
cpe:2.3:a:citrix:provisioning:2203:cu1:*:*:ltsr:*:*:*2203 cu1VulnerableCitrix
  • cpe:2.3:a:citrix:provisioning:*:*:*:*:-:*:*:* Versions up to 2311 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu1:*:*:ltsr:*:*:* Versions 1912 cu1 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu2:*:*:ltsr:*:*:* Versions 1912 cu2 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu3:*:*:ltsr:*:*:* Versions 1912 cu3 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu4:*:*:ltsr:*:*:* Versions 1912 cu4 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu5:*:*:ltsr:*:*:* Versions 1912 cu5 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu6:*:*:ltsr:*:*:* Versions 1912 cu6 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu7:*:*:ltsr:*:*:* Versions 1912 cu7 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:1912:cu8:*:*:ltsr:*:*:* Versions 1912 cu8 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:2203:cu1:*:*:ltsr:*:*:* Versions 2203 cu1 Vulnerable ·Citrix
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:citrix:provisioning:2203:cu2:*:*:ltsr:*:*:*2203 cu2VulnerableCitrix
cpe:2.3:a:citrix:provisioning:2203:cu3:*:*:ltsr:*:*:*2203 cu3VulnerableCitrix
cpe:2.3:a:citrix:provisioning:2203:cu4:*:*:ltsr:*:*:*2203 cu4VulnerableCitrix
  • cpe:2.3:a:citrix:provisioning:2203:cu2:*:*:ltsr:*:*:* Versions 2203 cu2 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:2203:cu3:*:*:ltsr:*:*:* Versions 2203 cu3 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:provisioning:2203:cu4:*:*:ltsr:*:*:* Versions 2203 cu4 Vulnerable ·Citrix

Remediation

  • Fix · CNA Citrix Provisioning (Citrix) Fixed in 0, CU5, CU9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6150
  2. 2026-10-03 Alias added: GHSA-j94j-pqhq-qr6h

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences