critical9.4Known exploited
CVE-2023-4966
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-10-18. Federal due date: 2023-11-08.
Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
Impact
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrix | Netscaler Application Delivery Controller | from 12.1 before 12.1-55.300 from 13.0 before 13.0-92.19 from 13.1 before 13.1-37.164 from 13.1 before 13.1-49.15 from 14.1 before 14.1-8.50 |
| Citrix | Netscaler Gateway | from 13.0 before 13.0-92.19 from 13.1 before 13.1-49.15 from 14.1 before 14.1-8.50 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html
- https://support.citrix.com/article/CTX579459
- http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html
- https://support.citrix.com/article/CTX579459
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966