CVE-2007-0011: Citrix Access Gateway

Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days.

The web portal interface in Citrix Access Gateway (aka Citrix Advanced Access Control) before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or browser cache.

Affected products

• Citrix Access Gateway: version 4.0 only; version 4.2 only; version 4.5 only

Published 2007-11-05. Last modified 2026-06-16.