Citrix · NetScaler ADC and NetScaler Gateway
CVE-2023-4966
Unauthenticated sensitive information disclosure
ما هي
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
CISA: Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
ما العمل
Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
الموعد النهائي للوكالات الفدرالية الأمريكية: 8 نوفمبر 2023
ثغرات مُستغلّة أخرى من Citrix
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 26/08/2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | مرتفع 8.8 | 1.0% |
| 17/01/2024 | Code Injection | NetScaler ADC and NetScaler Gateway | متوسطة 5.5 | 3.2% |
| 17/01/2024 | Buffer Overflow | NetScaler ADC and NetScaler Gateway | مرتفع 8.2 | 58% |
| 19/07/2023 | Code Injection | NetScaler ADC and NetScaler Gateway | حرجة 9.8 | 99.7% |
| 04/10/2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | مرتفع 8.7 | 11% |
| 27/09/2026 | Improper Input Validation | NetScaler | حرجة 9.5 | 82% |
| 27/09/2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | حرجة 9.5 | 78% |
| 09/09/2026 | Authentication Bypass Using an Alternate Path or Channel | NetScaler | حرجة 9.3 | 33% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.