cnvd - cnvd-2020-01639

cnvd-2020-01639

Vulnerability from cnvd

Title: Citrix Application Delivery Controller和Citrix Systems Gateway路径遍历漏洞

Description:

Citrix Systems NetScaler Gateway（Citrix Systems Gateway）和Citrix Application Delivery Controller（ADC）都是美国思杰系统（Citrix Systems）公司的产品。Citrix Systems NetScaler Gateway是一套安全的远程接入解决方案。该方案可为管理员提供应用级和数据级管控功能，以实现用户从任何地点远程访问应用和数据。Citrix Application Delivery Controller是一款应用交付控制器。该产品具有应用交付控制和负载均衡等功能。

Citrix Application Delivery Controller (ADC)和Citrix Systems Gateway中存在路径遍历漏洞，攻击者可利用该漏洞执行代码。

Severity: 高

Patch Name: Citrix Application Delivery Controller和Citrix Systems Gateway路径遍历漏洞的补丁

Patch Description:

Citrix Application Delivery Controller (ADC)和Citrix Systems Gateway中存在路径遍历漏洞，攻击者可利用该漏洞执行代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://support.citrix.com/article/CTX267027

Reference: https://www.auscert.org.au/bulletins/ESB-2019.4708/ https://www.kb.cert.org/vuls/id/619785/

Impacted products

Name
['Citrix Systems ADC and NetScaler Gateway 11.1', 'Citrix Systems ADC and NetScaler Gateway 12.0', 'Citrix Systems ADC and NetScaler Gateway 12.1', 'Citrix Systems ADC and Citrix Gateway 13.0', 'Citrix Systems NetScaler ADC and NetScaler Gateway 10.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-19781",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781"
    }
  },
  "description": "Citrix Systems NetScaler Gateway\uff08Citrix Systems Gateway\uff09\u548cCitrix Application Delivery Controller\uff08ADC\uff09\u90fd\u662f\u7f8e\u56fd\u601d\u6770\u7cfb\u7edf\uff08Citrix Systems\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Citrix Systems NetScaler Gateway\u662f\u4e00\u5957\u5b89\u5168\u7684\u8fdc\u7a0b\u63a5\u5165\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u53ef\u4e3a\u7ba1\u7406\u5458\u63d0\u4f9b\u5e94\u7528\u7ea7\u548c\u6570\u636e\u7ea7\u7ba1\u63a7\u529f\u80fd\uff0c\u4ee5\u5b9e\u73b0\u7528\u6237\u4ece\u4efb\u4f55\u5730\u70b9\u8fdc\u7a0b\u8bbf\u95ee\u5e94\u7528\u548c\u6570\u636e\u3002Citrix Application Delivery Controller\u662f\u4e00\u6b3e\u5e94\u7528\u4ea4\u4ed8\u63a7\u5236\u5668\u3002\u8be5\u4ea7\u54c1\u5177\u6709\u5e94\u7528\u4ea4\u4ed8\u63a7\u5236\u548c\u8d1f\u8f7d\u5747\u8861\u7b49\u529f\u80fd\u3002\n\nCitrix Application Delivery Controller (ADC)\u548cCitrix Systems Gateway\u4e2d\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://support.citrix.com/article/CTX267027",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-01639",
  "openTime": "2020-01-09",
  "patchDescription": "Citrix Systems NetScaler Gateway\uff08Citrix Systems Gateway\uff09\u548cCitrix Application Delivery Controller\uff08ADC\uff09\u90fd\u662f\u7f8e\u56fd\u601d\u6770\u7cfb\u7edf\uff08Citrix Systems\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Citrix Systems NetScaler Gateway\u662f\u4e00\u5957\u5b89\u5168\u7684\u8fdc\u7a0b\u63a5\u5165\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u53ef\u4e3a\u7ba1\u7406\u5458\u63d0\u4f9b\u5e94\u7528\u7ea7\u548c\u6570\u636e\u7ea7\u7ba1\u63a7\u529f\u80fd\uff0c\u4ee5\u5b9e\u73b0\u7528\u6237\u4ece\u4efb\u4f55\u5730\u70b9\u8fdc\u7a0b\u8bbf\u95ee\u5e94\u7528\u548c\u6570\u636e\u3002Citrix Application Delivery Controller\u662f\u4e00\u6b3e\u5e94\u7528\u4ea4\u4ed8\u63a7\u5236\u5668\u3002\u8be5\u4ea7\u54c1\u5177\u6709\u5e94\u7528\u4ea4\u4ed8\u63a7\u5236\u548c\u8d1f\u8f7d\u5747\u8861\u7b49\u529f\u80fd\u3002\r\n\r\nCitrix Application Delivery Controller (ADC)\u548cCitrix Systems Gateway\u4e2d\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Citrix Application Delivery Controller\u548cCitrix Systems Gateway\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Citrix Systems ADC and NetScaler Gateway 11.1",
      "Citrix Systems ADC and NetScaler Gateway 12.0",
      "Citrix Systems ADC and NetScaler Gateway 12.1",
      "Citrix Systems ADC and Citrix Gateway 13.0",
      "Citrix Systems NetScaler ADC and NetScaler Gateway 10.5"
    ]
  },
  "referenceLink": "https://www.auscert.org.au/bulletins/ESB-2019.4708/\r\nhttps://www.kb.cert.org/vuls/id/619785/",
  "serverity": "\u9ad8",
  "submitTime": "2019-12-18",
  "title": "Citrix Application Delivery Controller\u548cCitrix Systems Gateway\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

CVE-2019-19781 (GCVE-0-2019-19781)

Vulnerability from cvelistv5

Published

2019-12-27 13:06

Modified

2025-07-30 01:45

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

References

▼	URL	Tags
	https://support.citrix.com/article/CTX267027	x_refsource_CONFIRM
	https://www.kb.cert.org/vuls/id/619785	third-party-advisory, x_refsource_CERT-VN
	https://twitter.com/bad_packets/status/1215431625766424576	x_refsource_MISC
	https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/	x_refsource_MISC
	https://forms.gle/eDf3DXZAv96oosfj6	x_refsource_MISC
	http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html	x_refsource_MISC
	http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html	x_refsource_MISC
	http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html	x_refsource_MISC
	http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html	x_refsource_MISC
	http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:25:12.672Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX267027"
          },
          {
            "name": "VU#619785",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/619785"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/bad_packets/status/1215431625766424576"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://forms.gle/eDf3DXZAv96oosfj6"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2019-19781",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T20:02:18.414185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:45:51.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2019-19781 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-16T18:06:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX267027"
        },
        {
          "name": "VU#619785",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/619785"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/bad_packets/status/1215431625766424576"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://forms.gle/eDf3DXZAv96oosfj6"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-19781",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.citrix.com/article/CTX267027",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX267027"
            },
            {
              "name": "VU#619785",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/619785"
            },
            {
              "name": "https://twitter.com/bad_packets/status/1215431625766424576",
              "refsource": "MISC",
              "url": "https://twitter.com/bad_packets/status/1215431625766424576"
            },
            {
              "name": "https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/",
              "refsource": "MISC",
              "url": "https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/"
            },
            {
              "name": "https://forms.gle/eDf3DXZAv96oosfj6",
              "refsource": "MISC",
              "url": "https://forms.gle/eDf3DXZAv96oosfj6"
            },
            {
              "name": "http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-19781",
    "datePublished": "2019-12-27T13:06:46.000Z",
    "dateReserved": "2019-12-13T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:45:51.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted