CVE-2023-4966

high-risk

Published 2023-10-10

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

Do I need to act?

94.3% chance of exploitation in next 30 days

EPSS score — higher than 6% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.4/10 Critical

NETWORK / LOW complexity

Affected Products (4)

Netscaler Application Delivery Controller

Netscaler Gateway

Affected Vendors

Citrix

References (5)

Third Party Advisory http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-P...

Vendor Advisory https://support.citrix.com/article/CTX579459

Third Party Advisory http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-P...

Vendor Advisory https://support.citrix.com/article/CTX579459

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-...

/ 100

high-risk

Severity 31/34 · Critical

Exploitability 27/34 · High

Exposure 10/34 · Low