MetaFrame XP Presentation Server and MetaFrame 1.8 have a flaw that allows an administrator account to mount any client drive available in any user’s Citrix session.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33225/cqurecitrix.txt
Source: https://packetstormsecurity.com/files/33225/cqurecitrix.txt.html