Cloud Software Group NetScaler ADC
En bref
- Source
- NVD
- EPSS
- EPSS 3.19 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Citrix
- Statut NVD
- Analyzed
Description
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Faiblesses (CWE)
- CWE-94 — Injection de code
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | Citrix |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · secure@citrix.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-58778
- GCVE · GCVE-0-2023-6548
Avis du CERT-FR
- CERTFR-2024-AVI-0039 — Multiples vulnérabilités dans les produits Citrix · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*≥ 13.1 < 13.1-37.176cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*≥ 14.1 < 14.1-12.35cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*≥ 14.1 < 14.1-12.35
Produits affectés
| Produit | Versions |
|---|---|
| Cloud Software Group · NetScaler ADC | affected 14.1 < 12.35 ; affected 13.1 < 51.15 ; affected 13.0 < 92.21 ; affected 13.1-FIPS < 37.176 ; affected 12.1-FIPS < 55.302 ; affected 12.1-NDcPP < 55.302 |
| Cloud Software Group · NetScaler Gateway | affected 14.1 < 12.35 ; affected 13.1 < 51.15 ; affected 13.0 < 92.21 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |