Cloud Software Group NetScaler ADC
At a glance
- Source
- NVD
- EPSS
- EPSS 3.19 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Citrix
- NVD status
- Analyzed
Description
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | Citrix |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · secure@citrix.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-58778
- GCVE · GCVE-0-2023-6548
CERT-FR advisories
- CERTFR-2024-AVI-0039 — Multiples vulnérabilités dans les produits Citrix · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*≥ 13.1 < 13.1-37.176cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*≥ 14.1 < 14.1-12.35cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*≥ 14.1 < 14.1-12.35
Affected products
| Product | Versions |
|---|---|
| Cloud Software Group · NetScaler ADC | affected 14.1 < 12.35 ; affected 13.1 < 51.15 ; affected 13.0 < 92.21 ; affected 13.1-FIPS < 37.176 ; affected 12.1-FIPS < 55.302 ; affected 12.1-NDcPP < 55.302 |
| Cloud Software Group · NetScaler Gateway | affected 14.1 < 12.35 ; affected 13.1 < 51.15 ; affected 13.0 < 92.21 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |