Lucene search
CitrixCTX579459HistoryOct 10, 2023 - 12:07 p.m.
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967
2023-10-1012:07:11
support.citrix.com
47
netscaler
adc
gateway
vulnerabilities
buffer-related
citrix
customer-managed
versions
9.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
0.971 High
EPSS
Percentile
99.8%
Multiple vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway).
Affected Versions:
The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:
- NetScaler ADC and NetScaler Gateway14.1before14.1-8.50
- NetScaler ADC and NetScaler Gateway13.1before13.1-49.15
- NetScaler ADC and NetScaler Gateway13.0before 13.0-92.19
- NetScaler ADC 13.1-FIPS before 13.1-37.164
- NetScaler ADC 12.1-FIPS before 12.1-55.300
- NetScaler ADC 12.1-NDcPP before 12.1-55.300
Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and is vulnerable.
This bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway products. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.
Summary:
NetScaler ADC and NetScaler Gateway contain unauthenticated buffer-related vulnerabilities mentioned below
Affected configurations
Node
citrixnetscalerRange14.1≥
ORcitrixnetscalerRange≤8.50
ORcitrixnetscaler_gatewayRange14.1≥
ORcitrixnetscaler_gatewayRange≤8.50
ORcitrixnetscalerRange13.1≥
ORcitrixnetscalerRange≤49.15
ORcitrixnetscalerRange14.0.0≥
ORcitrixnetscalerRange15.0.0≥
ORcitrixnetscalerRange16.0.0≥
ORcitrixnetscalerRange17.0.0≥
ORcitrixnetscalerRange18.0.0≥
ORcitrixnetscalerRange19.0.0≥
ORcitrixnetscalerRange20.0.0≥
ORcitrixnetscalerRange21.0.0≥
ORcitrixnetscalerRange22.0.0≥
ORcitrixnetscalerRange23.0.0≥
ORcitrixnetscalerRange24.0.0≥
ORcitrixnetscalerRange25.0.0≥
ORcitrixnetscalerRange26.0.0≥
ORcitrixnetscalerRange27.0.0≥
ORcitrixnetscalerRange28.0.0≥
ORcitrixnetscalerRange29.0.0≥
ORcitrixnetscalerRange30.0.0≥
ORcitrixnetscalerRange31.0.0≥
ORcitrixnetscalerRange32.0.0≥
ORcitrixnetscalerRange33.0.0≥
ORcitrixnetscalerRange34.0.0≥
ORcitrixnetscalerRange35.0.0≥
ORcitrixnetscalerRange36.0.0≥
ORcitrixnetscalerRange37.0.0≥
ORcitrixnetscalerRange38.0.0≥
ORcitrixnetscalerRange39.0.0≥
ORcitrixnetscalerRange40.0.0≥
ORcitrixnetscalerRange41.0.0≥
ORcitrixnetscalerRange42.0.0≥
ORcitrixnetscalerRange43.0.0≥
ORcitrixnetscalerRange44.0.0≥
ORcitrixnetscalerRange45.0.0≥
ORcitrixnetscalerRange46.0.0≥
ORcitrixnetscalerRange47.0.0≥
ORcitrixnetscalerRange48.0.0≥
ORcitrixnetscaler_gatewayRange13.1≥
ORcitrixnetscaler_gatewayRange≤49.15
ORcitrixnetscaler_gatewayRange14.0.0≥
ORcitrixnetscaler_gatewayRange15.0.0≥
ORcitrixnetscaler_gatewayRange16.0.0≥
ORcitrixnetscaler_gatewayRange17.0.0≥
ORcitrixnetscaler_gatewayRange18.0.0≥
ORcitrixnetscaler_gatewayRange19.0.0≥
ORcitrixnetscaler_gatewayRange20.0.0≥
ORcitrixnetscaler_gatewayRange21.0.0≥
ORcitrixnetscaler_gatewayRange22.0.0≥
ORcitrixnetscaler_gatewayRange23.0.0≥
ORcitrixnetscaler_gatewayRange24.0.0≥
ORcitrixnetscaler_gatewayRange25.0.0≥
ORcitrixnetscaler_gatewayRange26.0.0≥
ORcitrixnetscaler_gatewayRange27.0.0≥
ORcitrixnetscaler_gatewayRange28.0.0≥
ORcitrixnetscaler_gatewayRange29.0.0≥
ORcitrixnetscaler_gatewayRange30.0.0≥
ORcitrixnetscaler_gatewayRange31.0.0≥
ORcitrixnetscaler_gatewayRange32.0.0≥
ORcitrixnetscaler_gatewayRange33.0.0≥
ORcitrixnetscaler_gatewayRange34.0.0≥
ORcitrixnetscaler_gatewayRange35.0.0≥
ORcitrixnetscaler_gatewayRange36.0.0≥
ORcitrixnetscaler_gatewayRange37.0.0≥
ORcitrixnetscaler_gatewayRange38.0.0≥
ORcitrixnetscaler_gatewayRange39.0.0≥
ORcitrixnetscaler_gatewayRange40.0.0≥
ORcitrixnetscaler_gatewayRange41.0.0≥
ORcitrixnetscaler_gatewayRange42.0.0≥
ORcitrixnetscaler_gatewayRange43.0.0≥
ORcitrixnetscaler_gatewayRange44.0.0≥
ORcitrixnetscaler_gatewayRange45.0.0≥
ORcitrixnetscaler_gatewayRange46.0.0≥
ORcitrixnetscaler_gatewayRange47.0.0≥
ORcitrixnetscaler_gatewayRange48.0.0≥
ORcitrixnetscalerRange13.0≥
ORcitrixnetscalerRange≤92.19
ORcitrixnetscalerRange14.0.0≥
ORcitrixnetscalerRange15.0.0≥
ORcitrixnetscalerRange16.0.0≥
ORcitrixnetscalerRange17.0.0≥
ORcitrixnetscalerRange18.0.0≥
ORcitrixnetscalerRange19.0.0≥
ORcitrixnetscalerRange20.0.0≥
ORcitrixnetscalerRange21.0.0≥
ORcitrixnetscalerRange22.0.0≥
ORcitrixnetscalerRange23.0.0≥
ORcitrixnetscalerRange24.0.0≥
ORcitrixnetscalerRange25.0.0≥
ORcitrixnetscalerRange26.0.0≥
ORcitrixnetscalerRange27.0.0≥
ORcitrixnetscalerRange28.0.0≥
ORcitrixnetscalerRange29.0.0≥
ORcitrixnetscalerRange30.0.0≥
ORcitrixnetscalerRange31.0.0≥
ORcitrixnetscalerRange32.0.0≥
ORcitrixnetscalerRange33.0.0≥
ORcitrixnetscalerRange34.0.0≥
ORcitrixnetscalerRange35.0.0≥
ORcitrixnetscalerRange36.0.0≥
ORcitrixnetscalerRange37.0.0≥
ORcitrixnetscalerRange38.0.0≥
ORcitrixnetscalerRange39.0.0≥
ORcitrixnetscalerRange40.0.0≥
ORcitrixnetscalerRange41.0.0≥
ORcitrixnetscalerRange42.0.0≥
ORcitrixnetscalerRange43.0.0≥
ORcitrixnetscalerRange44.0.0≥
ORcitrixnetscalerRange45.0.0≥
ORcitrixnetscalerRange46.0.0≥
ORcitrixnetscalerRange47.0.0≥
ORcitrixnetscalerRange48.0.0≥
ORcitrixnetscalerRange49.0.0≥
ORcitrixnetscalerRange50.0.0≥
ORcitrixnetscalerRange51.0.0≥
ORcitrixnetscalerRange52.0.0≥
ORcitrixnetscalerRange53.0.0≥
ORcitrixnetscalerRange54.0.0≥
ORcitrixnetscalerRange55.0.0≥
ORcitrixnetscalerRange56.0.0≥
ORcitrixnetscalerRange57.0.0≥
ORcitrixnetscalerRange58.0.0≥
ORcitrixnetscalerRange59.0.0≥
ORcitrixnetscalerRange60.0.0≥
ORcitrixnetscalerRange61.0.0≥
ORcitrixnetscalerRange62.0.0≥
ORcitrixnetscalerRange63.0.0≥
ORcitrixnetscalerRange64.0.0≥
ORcitrixnetscalerRange65.0.0≥
ORcitrixnetscalerRange66.0.0≥
ORcitrixnetscalerRange67.0.0≥
ORcitrixnetscalerRange68.0.0≥
ORcitrixnetscalerRange69.0.0≥
ORcitrixnetscalerRange70.0.0≥
ORcitrixnetscalerRange71.0.0≥
ORcitrixnetscalerRange72.0.0≥
ORcitrixnetscalerRange73.0.0≥
ORcitrixnetscalerRange74.0.0≥
ORcitrixnetscalerRange75.0.0≥
ORcitrixnetscalerRange76.0.0≥
ORcitrixnetscalerRange77.0.0≥
ORcitrixnetscalerRange78.0.0≥
ORcitrixnetscalerRange79.0.0≥
ORcitrixnetscalerRange80.0.0≥
ORcitrixnetscalerRange81.0.0≥
ORcitrixnetscalerRange82.0.0≥
ORcitrixnetscalerRange83.0.0≥
ORcitrixnetscalerRange84.0.0≥
ORcitrixnetscalerRange85.0.0≥
ORcitrixnetscalerRange86.0.0≥
ORcitrixnetscalerRange87.0.0≥
ORcitrixnetscalerRange88.0.0≥
ORcitrixnetscalerRange89.0.0≥
ORcitrixnetscalerRange90.0.0≥
ORcitrixnetscalerRange91.0.0≥
ORcitrixnetscaler_gatewayRange13.0≥
ORcitrixnetscaler_gatewayRange≤92.19
ORcitrixnetscaler_gatewayRange14.0.0≥
ORcitrixnetscaler_gatewayRange15.0.0≥
ORcitrixnetscaler_gatewayRange16.0.0≥
ORcitrixnetscaler_gatewayRange17.0.0≥
ORcitrixnetscaler_gatewayRange18.0.0≥
ORcitrixnetscaler_gatewayRange19.0.0≥
ORcitrixnetscaler_gatewayRange20.0.0≥
ORcitrixnetscaler_gatewayRange21.0.0≥
ORcitrixnetscaler_gatewayRange22.0.0≥
ORcitrixnetscaler_gatewayRange23.0.0≥
ORcitrixnetscaler_gatewayRange24.0.0≥
ORcitrixnetscaler_gatewayRange25.0.0≥
ORcitrixnetscaler_gatewayRange26.0.0≥
ORcitrixnetscaler_gatewayRange27.0.0≥
ORcitrixnetscaler_gatewayRange28.0.0≥
ORcitrixnetscaler_gatewayRange29.0.0≥
ORcitrixnetscaler_gatewayRange30.0.0≥
ORcitrixnetscaler_gatewayRange31.0.0≥
ORcitrixnetscaler_gatewayRange32.0.0≥
ORcitrixnetscaler_gatewayRange33.0.0≥
ORcitrixnetscaler_gatewayRange34.0.0≥
ORcitrixnetscaler_gatewayRange35.0.0≥
ORcitrixnetscaler_gatewayRange36.0.0≥
ORcitrixnetscaler_gatewayRange37.0.0≥
ORcitrixnetscaler_gatewayRange38.0.0≥
ORcitrixnetscaler_gatewayRange39.0.0≥
ORcitrixnetscaler_gatewayRange40.0.0≥
ORcitrixnetscaler_gatewayRange41.0.0≥
ORcitrixnetscaler_gatewayRange42.0.0≥
ORcitrixnetscaler_gatewayRange43.0.0≥
ORcitrixnetscaler_gatewayRange44.0.0≥
ORcitrixnetscaler_gatewayRange45.0.0≥
ORcitrixnetscaler_gatewayRange46.0.0≥
ORcitrixnetscaler_gatewayRange47.0.0≥
ORcitrixnetscaler_gatewayRange48.0.0≥
ORcitrixnetscaler_gatewayRange49.0.0≥
ORcitrixnetscaler_gatewayRange50.0.0≥
ORcitrixnetscaler_gatewayRange51.0.0≥
ORcitrixnetscaler_gatewayRange52.0.0≥
ORcitrixnetscaler_gatewayRange53.0.0≥
ORcitrixnetscaler_gatewayRange54.0.0≥
ORcitrixnetscaler_gatewayRange55.0.0≥
ORcitrixnetscaler_gatewayRange56.0.0≥
ORcitrixnetscaler_gatewayRange57.0.0≥
ORcitrixnetscaler_gatewayRange58.0.0≥
ORcitrixnetscaler_gatewayRange59.0.0≥
ORcitrixnetscaler_gatewayRange60.0.0≥
ORcitrixnetscaler_gatewayRange61.0.0≥
ORcitrixnetscaler_gatewayRange62.0.0≥
ORcitrixnetscaler_gatewayRange63.0.0≥
ORcitrixnetscaler_gatewayRange64.0.0≥
ORcitrixnetscaler_gatewayRange65.0.0≥
ORcitrixnetscaler_gatewayRange66.0.0≥
ORcitrixnetscaler_gatewayRange67.0.0≥
ORcitrixnetscaler_gatewayRange68.0.0≥
ORcitrixnetscaler_gatewayRange69.0.0≥
ORcitrixnetscaler_gatewayRange70.0.0≥
ORcitrixnetscaler_gatewayRange71.0.0≥
ORcitrixnetscaler_gatewayRange72.0.0≥
ORcitrixnetscaler_gatewayRange73.0.0≥
ORcitrixnetscaler_gatewayRange74.0.0≥
ORcitrixnetscaler_gatewayRange75.0.0≥
ORcitrixnetscaler_gatewayRange76.0.0≥
ORcitrixnetscaler_gatewayRange77.0.0≥
ORcitrixnetscaler_gatewayRange78.0.0≥
ORcitrixnetscaler_gatewayRange79.0.0≥
ORcitrixnetscaler_gatewayRange80.0.0≥
ORcitrixnetscaler_gatewayRange81.0.0≥
ORcitrixnetscaler_gatewayRange82.0.0≥
ORcitrixnetscaler_gatewayRange83.0.0≥
ORcitrixnetscaler_gatewayRange84.0.0≥
ORcitrixnetscaler_gatewayRange85.0.0≥
ORcitrixnetscaler_gatewayRange86.0.0≥
ORcitrixnetscaler_gatewayRange87.0.0≥
ORcitrixnetscaler_gatewayRange88.0.0≥
ORcitrixnetscaler_gatewayRange89.0.0≥
ORcitrixnetscaler_gatewayRange90.0.0≥
ORcitrixnetscaler_gatewayRange91.0.0≥
ORcitrixnetscalerRange≤13.1
ORcitrixnetscalerRange≤12.1
ORcitrixnetscalerRange≤12.1
Related
nessus
nessus
NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX579459)
2023-10-13 00:00:00
rapid7blog
rapid7blog
CVE-2023-4966: Exploitation of Citrix NetScaler Information Disclosure Vulnerability
2023-10-25 18:18:15
Metasploit Weekly Wrap-Up
2023-11-03 19:10:16
ics
ics
cvelist
cvelist
CVE-2023-4966 Unauthenticated sensitive information disclosure
2023-10-10 13:12:17
CVE-2023-4967 Denial of service
2023-10-27 18:01:59
malwarebytes
malwarebytes
Citrix Bleed widely exploited, warn government agencies
2023-11-24 19:20:11
Ransomware review: December 2023
2023-12-13 19:22:12
cve
cve
CVE-2023-4966
2023-10-10 14:15:10
CVE-2023-4967
2023-10-27 19:15:41
githubexploit
githubexploit
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler Application Delivery Controller
2023-10-25 07:17:54
hackerone
hackerone
U.S. Dept Of Defense: Out-Of-Bounds Memory Read on ███
2024-05-16 19:04:15
hackread
hackread
Mandiant Tracks Four Uncategorized Groups Exploiting Citrix Vulnerability
2023-11-01 22:14:45
thn
thn
Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities
2023-10-25 04:47:00
nvd
nvd
CVE-2023-4967
2023-10-27 19:15:41
CVE-2023-4966
2023-10-10 14:15:10
prion
prion
Denial of service
2023-10-27 19:15:00
Information disclosure
2023-10-10 14:15:00
attackerkb
attackerkb
CVE-2023-4966
2023-10-10 00:00:00
metasploit
metasploit
Citrix ADC (NetScaler) Bleed Scanner
2023-10-26 13:15:03
hivepro
hivepro
A Longstanding Zero-Day in Citrix Devices Exploited Since August
2023-10-20 12:47:00
cisa_kev
cisa_kev
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
2023-10-18 00:00:00
nuclei
nuclei
Citrix Bleed - Leaking Session Tokens
2023-10-24 10:58:04
talosblog
talosblog
avleonov
avleonov
9.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
0.971 High
EPSS
Percentile
99.8%
Related for CTX579459