9.3
CVE-2010-4566
- EPSS 27.8%
- Veröffentlicht 14.01.2011 23:00:47
- Zuletzt bearbeitet 16.06.2026 23:25:04
- Erkennungen
The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0, allows attackers to execute arbitrary commands via shell metacharacters in the password field.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Citrix ≫ Access Gateway Edition enterprise Version <= 9.2-49.8
Citrix ≫ Access Gateway Version .8.0 Update m50.3 Edition enterprise
Citrix ≫ Access Gateway Version 8.0 Update m48.7 Edition enterprise
Citrix ≫ Access Gateway Version 8.0 Update m49.2 Edition enterprise
Citrix ≫ Access Gateway Version 8.0 Update m59.1 Edition enterprise
Citrix ≫ Access Gateway Version 8.1-69.4 Edition enterprise
Citrix ≫ Access Gateway Version 9.0.71.3 Edition enterprise
Citrix ≫ Access Gateway Version 9.1-104.5 Edition enterprise
Citrix ≫ Access Gateway Version 4.5 Edition advanced
Citrix ≫ Access Gateway Version 4.5 Edition standard
Citrix ≫ Access Gateway Version 4.5 Update hf1
Citrix ≫ Access Gateway Version 4.5 Update hf1 Edition advanced
Citrix ≫ Access Gateway Version 4.5.5 Edition standard
Citrix ≫ Access Gateway Version 4.5.6 Edition standard
Citrix ≫ Access Gateway Version 4.5.7 Edition standard
Citrix ≫ Access Gateway Version 4.6.1 Edition standard
Citrix ≫ Access Gateway Version 4.6.2 Edition standard
Citrix ≫ Access Gateway Version 4.6.3 Edition standard
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 27.8% | 0.978 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
http://securityreason.com/securityalert/8119
http://support.citrix.com/article/CTX127613
http://www.exploit-db.com/exploits/16916
http://www.osvdb.org/70099
http://www.securitytracker.com/id?1024893
http://www.vsecurity.com/resources/advisory/20101221-1