8.8

CVE-2023-6548

Warnung

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Citrix ≫ Netscaler Application Delivery Controller SwEditionfips Version >= 12.1 < 12.1-55.302
Citrix ≫ Netscaler Application Delivery Controller SwEditionndcpp Version >= 12.1 < 12.1-55.302
Citrix ≫ Netscaler Application Delivery Controller SwEdition- Version >= 13.0 < 13.0-92.21
Citrix ≫ Netscaler Application Delivery Controller SwEditionfips Version >= 13.1 < 13.1-37.176
Citrix ≫ Netscaler Application Delivery Controller SwEdition- Version >= 13.1 < 13.1-51.15
Citrix ≫ Netscaler Application Delivery Controller SwEdition- Version >= 14.1 < 14.1-12.35
Citrix ≫ NetScaler Gateway Version >= 13.0 < 13.0-92.21
Citrix ≫ NetScaler Gateway Version >= 13.1 < 13.1-51.15
Citrix ≫ NetScaler Gateway Version >= 14.1 < 14.1-12.35

17.01.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Schwachstelle

Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 17.8% 0.949
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
secure@citrix.com 5.5 2.1 3.4
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.