certfr_avis - certfr-2024-avi-0039

CERTFR-2024-AVI-0039

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Citrix. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Citrix StoreFront versions 2308.x antérieures à 2308.1
Citrix StoreFront versions antérieures à 2311
Citrix StoreFront versions 1912 LSTR antérieures à 1912 LTSR CU8 hotfix 3.22.8001.2
Citrix StoreFront versions 2203 LSTR antérieures à 2203 LTSR CU4 Update 1
Citrix Virtual Apps and Desktops versions antérieures à 2311
Citrix Virtual Apps and Desktops versions 1912 LTSR antérieures à 1912 LTSR CU8 hotfix 19.12.8100.4
Citrix Virtual Apps and Desktops versions 2203 LSTR antérieures à 2203 LTSR CU4
NetScaler ADC et NetScaler Gateway versions 14.1.x versions antérieures à 14.1-12.35
NetScaler ADC et NetScaler Gateway versions 13.1.x versions antérieures à 13.1-51.15
NetScaler ADC et NetScaler Gateway versions 13.0.x versions antérieures à 13.0-92.21
NetScaler ADC versions 13.1.x-FIPS versions antérieures à 13.1-37.176
NetScaler ADC versions 12.1.x-FIPS versions antérieures à 12.1-55.302
NetScaler ADC versions 12.1.x-NDcPP versions antérieures à 12.1-55.302

L’éditeur précise que les produits NetScaler ADC and NetScaler Gateway en versions 12.1 sont en fin de vie (EOL) et ne bénéficient plus de mises à jour de sécurité.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Citrix CTX584986 du 16 janvier 2024	None	vendor-advisory
Bulletin de sécurité Citrix CTX583759 du 16 janvier 2024	None	vendor-advisory
Bulletin de sécurité Citrix CTX583930 du 16 janvier 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eCitrix StoreFront versions 2308.x ant\u00e9rieures \u00e0 2308.1\u003c/li\u003e \u003cli\u003eCitrix StoreFront versions ant\u00e9rieures \u00e0 2311\u003c/li\u003e \u003cli\u003eCitrix StoreFront versions 1912 LSTR ant\u00e9rieures \u00e0 1912 LTSR CU8 hotfix 3.22.8001.2\u003c/li\u003e \u003cli\u003eCitrix StoreFront versions 2203 LSTR ant\u00e9rieures \u00e0 2203 LTSR CU4 Update 1\u003c/li\u003e \u003cli\u003eCitrix Virtual Apps and Desktops versions ant\u00e9rieures \u00e0 2311\u003c/li\u003e \u003cli\u003eCitrix Virtual Apps and Desktops versions 1912 LTSR ant\u00e9rieures \u00e0 1912 LTSR CU8 hotfix 19.12.8100.4\u003c/li\u003e \u003cli\u003eCitrix Virtual Apps and Desktops versions 2203 LSTR ant\u00e9rieures \u00e0 2203 LTSR CU4\u003c/li\u003e \u003cli\u003eNetScaler ADC et NetScaler Gateway\u202fversions 14.1.x\u202fversions ant\u00e9rieures \u00e0\u202f14.1-12.35\u003c/li\u003e \u003cli\u003eNetScaler ADC et NetScaler Gateway\u202fversions 13.1.x\u202fversions ant\u00e9rieures \u00e0\u202f13.1-51.15\u003c/li\u003e \u003cli\u003eNetScaler ADC et NetScaler Gateway\u202fversions 13.0.x\u202fversions ant\u00e9rieures \u00e0 13.0-92.21\u003c/li\u003e \u003cli\u003eNetScaler ADC versions 13.1.x-FIPS versions ant\u00e9rieures \u00e0 13.1-37.176\u003c/li\u003e \u003cli\u003eNetScaler ADC versions 12.1.x-FIPS versions ant\u00e9rieures \u00e0 12.1-55.302\u003c/li\u003e \u003cli\u003eNetScaler ADC versions 12.1.x-NDcPP versions ant\u00e9rieures \u00e0 12.1-55.302\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u2019\u00e9diteur pr\u00e9cise que les produits NetScaler ADC and NetScaler Gateway en versions 12.1 sont en fin de vie (\u003cem\u003eEOL\u003c/em\u003e) et ne b\u00e9n\u00e9ficient plus de mises \u00e0 jour de s\u00e9curit\u00e9.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-6548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6548"
    },
    {
      "name": "CVE-2023-5914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5914"
    },
    {
      "name": "CVE-2023-6184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6184"
    },
    {
      "name": "CVE-2023-6549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6549"
    }
  ],
  "initial_release_date": "2024-01-16T00:00:00",
  "last_revision_date": "2024-01-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0039",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-01-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nCitrix. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\ninjection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Citrix",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Citrix CTX584986 du 16 janvier 2024",
      "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Citrix CTX583759 du 16 janvier 2024",
      "url": "https://support.citrix.com/article/CTX583759/citrix-storefront-security-bulletin-for-cve20235914"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Citrix CTX583930 du 16 janvier 2024",
      "url": "https://support.citrix.com/article/CTX583930/citrix-session-recording-security-bulletin-for-cve20236184"
    }
  ]
}

CVE-2023-6549 (GCVE-0-2023-6549)

Vulnerability from cvelistv5

Published

2024-01-17 20:15

Modified

2025-10-21 23:05

Severity ?

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Summary

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

References

URL

Tags

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549

Impacted products

	Vendor	Product	Version
	Cloud Software Group	NetScaler ADC	Version: 14.1 Version: 13.1 Version: 13.0 Version: 13.1-FIPS Version: 12.1-FIPS Version: 12.1-NDcPP

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:13.934Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6549",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-31T05:00:20.477654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-01-17",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6549"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:27.936Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6549"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-01-17T00:00:00+00:00",
            "value": "CVE-2023-6549 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NetScaler ADC\u202f",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "lessThan": "12.35",
              "status": "affected",
              "version": "14.1",
              "versionType": "patch"
            },
            {
              "lessThan": "51.15",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            },
            {
              "lessThan": "92.21",
              "status": "affected",
              "version": "13.0 ",
              "versionType": "patch"
            },
            {
              "lessThan": "37.176",
              "status": "affected",
              "version": " 13.1-FIPS",
              "versionType": "patch"
            },
            {
              "lessThan": "55.302",
              "status": "affected",
              "version": "12.1-FIPS",
              "versionType": "patch"
            },
            {
              "lessThan": "55.302",
              "status": "affected",
              "version": "12.1-NDcPP",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cb\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eImproper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and\u0026nbsp;\u003c/span\u003e\u003c/b\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cb\u003eOut-Of-Bounds Memory Read\u003c/b\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and\u00a0Out-Of-Bounds Memory Read\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-10T17:29:28.138Z",
        "orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
        "shortName": "Citrix"
      },
      "references": [
        {
          "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
    "assignerShortName": "Citrix",
    "cveId": "CVE-2023-6549",
    "datePublished": "2024-01-17T20:15:53.345Z",
    "dateReserved": "2023-12-06T11:01:58.256Z",
    "dateUpdated": "2025-10-21T23:05:27.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6184 (GCVE-0-2023-6184)

Vulnerability from cvelistv5

Published

2024-01-18 01:04

Modified

2025-06-02 15:04

Severity ?

5.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-913 - Improper Control of Dynamically-Managed Code Resources

Summary

Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting

References

URL

Tags

https://support.citrix.com/article/CTX583930/citrix-session-recording-security-bulletin-for-cve20236184

Impacted products

	Vendor	Product	Version
	Cloud Software Group	Citrix Session Recording	Version: 2311 Current Release Version: 1912 LTSR Version: 2203 LTSR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:21:17.772Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX583930/citrix-session-recording-security-bulletin-for-cve20236184"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:53:46.961310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-02T15:04:27.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Citrix Session Recording",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "lessThan": "0",
              "status": "affected",
              "version": "2311 Current Release",
              "versionType": "patch"
            },
            {
              "lessThan": "CU8 hotfix 19.12.8100.4",
              "status": "affected",
              "version": "1912 LTSR ",
              "versionType": "patch"
            },
            {
              "lessThan": "CU4",
              "status": "affected",
              "version": "2203 LTSR",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting"
            }
          ],
          "value": "Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-18T01:04:15.120Z",
        "orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
        "shortName": "Citrix"
      },
      "references": [
        {
          "url": "https://support.citrix.com/article/CTX583930/citrix-session-recording-security-bulletin-for-cve20236184"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
    "assignerShortName": "Citrix",
    "cveId": "CVE-2023-6184",
    "datePublished": "2024-01-18T01:04:15.120Z",
    "dateReserved": "2023-11-16T21:18:24.367Z",
    "dateUpdated": "2025-06-02T15:04:27.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6548 (GCVE-0-2023-6548)

Vulnerability from cvelistv5

Published

2024-01-17 20:11

Modified

2025-10-21 23:05

Severity ?

5.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Summary

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

References

URL

Tags

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549

Impacted products

Vendor

Product

Version

Cloud Software Group

NetScaler ADC 

Version: 14.1
Version: 13.1
Version: 13.0
Version: 13.1-FIPS
Version: 12.1-FIPS
Version: 12.1-NDcPP

Cloud Software Group

NetScaler Gateway

Version: 14.1
Version: 13.1
Version: 13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1:*:*:*:-:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_application_delivery_controller",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "14.1-12.35",
                "status": "affected",
                "version": "14.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_application_delivery_controller:13.1:*:*:*:-:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_application_delivery_controller",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "13.1-51.15",
                "status": "affected",
                "version": "13.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_application_delivery_controller:13.0:*:*:*:-:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_application_delivery_controller",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "13.0-92.21",
                "status": "affected",
                "version": "13.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_application_delivery_controller:13.1:*:*:*:fips:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_application_delivery_controller",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "13.1-37.176",
                "status": "affected",
                "version": "13.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_application_delivery_controller:12.1:*:*:*:fips:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_application_delivery_controller",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "12.1-55.302",
                "status": "affected",
                "version": "12.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_application_delivery_controller:12.1:*:*:*:ndcpp:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_application_delivery_controller",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "12.1-55.302",
                "status": "affected",
                "version": "12.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_gateway:14.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_gateway",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "14.1-12.35",
                "status": "affected",
                "version": "14.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_gateway:13.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_gateway",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "13.1-51.15",
                "status": "affected",
                "version": "13.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:citrix:netscaler_gateway:13.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netscaler_gateway",
            "vendor": "citrix",
            "versions": [
              {
                "lessThan": "13.0-92.21",
                "status": "affected",
                "version": "13.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6548",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-18T14:00:57.375485Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-01-17",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:28.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-01-17T00:00:00+00:00",
            "value": "CVE-2023-6548 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:14.029Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NetScaler ADC\u202f",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "lessThan": "12.35",
              "status": "affected",
              "version": "14.1",
              "versionType": "patch"
            },
            {
              "lessThan": "51.15",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            },
            {
              "lessThan": "92.21",
              "status": "affected",
              "version": "13.0 ",
              "versionType": "patch"
            },
            {
              "lessThan": "37.176",
              "status": "affected",
              "version": " 13.1-FIPS",
              "versionType": "patch"
            },
            {
              "lessThan": "55.302",
              "status": "affected",
              "version": "12.1-FIPS",
              "versionType": "patch"
            },
            {
              "lessThan": "55.302",
              "status": "affected",
              "version": "12.1-NDcPP",
              "versionType": "patch"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NetScaler Gateway",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "lessThan": "12.35",
              "status": "affected",
              "version": "14.1",
              "versionType": "patch"
            },
            {
              "lessThan": "51.15",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            },
            {
              "lessThan": "92.21",
              "status": "affected",
              "version": "13.0",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eImproper Control of Generation of Code (\u0027Code Injection\u0027) in NetScaler ADC and NetScaler Gateway\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallows an attacker with\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;access\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;to NSIP, CLIP or SNIP with management interface to perform\u003c/span\u003e\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAuthenticated (low privileged) remote code execution on Management Interface.\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e"
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in NetScaler ADC and NetScaler Gateway\u00a0allows an attacker with\u00a0access\u00a0to NSIP, CLIP or SNIP with management interface to perform\u00a0Authenticated (low privileged) remote code execution on Management Interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-18T01:12:54.917Z",
        "orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
        "shortName": "Citrix"
      },
      "references": [
        {
          "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
    "assignerShortName": "Citrix",
    "cveId": "CVE-2023-6548",
    "datePublished": "2024-01-17T20:11:18.462Z",
    "dateReserved": "2023-12-06T11:01:54.643Z",
    "dateUpdated": "2025-10-21T23:05:28.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5914 (GCVE-0-2023-5914)

Vulnerability from cvelistv5

Published

2024-01-17 20:19

Modified

2025-06-17 21:19

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

Cross-site scripting (XSS)

References

URL

Tags

https://support.citrix.com/article/CTX583759/citrix-storefront-security-bulletin-for-cve20235914

Impacted products

	Vendor	Product	Version
	Cloud Software Group	Citrix StoreFront	Version: 2308 Current Release Version: 2311 Current Release Version: 1912 LTSR Version: 2203 LTSR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:14:24.983Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX583759/citrix-storefront-security-bulletin-for-cve20235914"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-18T01:07:35.301720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:19:18.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Citrix StoreFront",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "lessThan": "1",
              "status": "affected",
              "version": "2308 Current Release",
              "versionType": "patch"
            },
            {
              "lessThan": "0",
              "status": "affected",
              "version": "2311 Current Release",
              "versionType": "patch"
            },
            {
              "lessThan": "CU8 hotfix 3.22.8001.2",
              "status": "affected",
              "version": "1912 LTSR",
              "versionType": "patch"
            },
            {
              "lessThan": "CU4 Update 1",
              "status": "affected",
              "version": "2203 LTSR ",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u0026nbsp; Cross-site scripting (XSS)"
            }
          ],
          "value": "\u00a0 Cross-site scripting (XSS)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-17T20:19:49.869Z",
        "orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
        "shortName": "Citrix"
      },
      "references": [
        {
          "url": "https://support.citrix.com/article/CTX583759/citrix-storefront-security-bulletin-for-cve20235914"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
    "assignerShortName": "Citrix",
    "cveId": "CVE-2023-5914",
    "datePublished": "2024-01-17T20:19:49.869Z",
    "dateReserved": "2023-11-01T22:55:27.290Z",
    "dateUpdated": "2025-06-17T21:19:18.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2024-AVI-0039

Vulnerability from certfr_avis

Solution

CVE-2023-6549 (GCVE-0-2023-6549)

Vulnerability from cvelistv5

CVE-2023-6184 (GCVE-0-2023-6184)

Vulnerability from cvelistv5

CVE-2023-6548 (GCVE-0-2023-6548)

Vulnerability from cvelistv5

CVE-2023-5914 (GCVE-0-2023-5914)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature