← Vulnerability feed

Vulnerability record · CVE-2015-2682 · published 26 March 2015

CVE-2015-2682: Citrix command center vulnerability

Citrix · Command Center

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.

5.0 CVSS 2.0 Medium EPSS 11% · top 4.3% CWE-17 · CWE-17
5.0CVSS 2.0 base score
11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Mar/126 Mailing ListThird Party Advisory
http://support.citrix.com/article/CTX200584 Vendor Advisory
http://www.securityfocus.com/bid/73309 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1031993 Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/36441/ Third Party AdvisoryVDB Entry
https://www.securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html Exploit
http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Mar/126 Mailing ListThird Party Advisory
http://support.citrix.com/article/CTX200584 Vendor Advisory
http://www.securityfocus.com/bid/73309 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1031993 Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/36441/ Third Party AdvisoryVDB Entry
https://www.securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html Exploit

Track CVE-2015-2682 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2015-7999Citrix command center sql injection vulnerabilityMultiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.1…EPSS 2.1%7.5CVE-2015-2683Citrix command center permissions and access controls vulnerabilityCitrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX…EPSS 5.2%7.3CVE-2024-43093Android ExternalStorageProvider path filter bypass via unicode normalizationExternalStorageProvider.java's shouldHideDocument function fails to correctly normalize unicode, allowing a crafted file path to bypass the filter th…KEVEPSS 0.72%analysed9.8CVE-2020-12812FortiOS SSL VPN two-factor authentication bypass via username case changeFortiOS SSL VPN fails to enforce the second authentication factor (FortiToken) when a user alters the letter case of their username. Because the user…KEVEPSS 49%analysed

Source: NIST National Vulnerability Database (record CVE-2015-2682), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.