PT-2015-5924 · Citrix · Citrix Netscaler

Cengiz Han Sahin · Publicado 2015-04-03 · Atualizado 2018-10-09 · CVE-2015-2839

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Citrix NetScaler versions prior to 10.5 build 52.3nc

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks. This is achieved by exploiting the Nitro API, which returns an error message with an incorrect Content-Type, via the file name JSON member in the "params/xen hotfix/0" to "nitro/v1/config/xen hotfix" API endpoint.

Recommendations For versions prior to 10.5 build 52.3nc, update to build 52.3nc or later to resolve the issue. As a temporary workaround, consider restricting access to the Nitro API to minimize the risk of exploitation. Avoid using the file name JSON member in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-2839

Produtos afetados

Citrix Netscaler

Referências · 7

• 🔥 http://packetstormsecurity.com/files/130931/Citrix-NITRO-SDK-xen_hotfix-Cross-Site-Scripting.html · Exploit
• 🔥 https://securify.nl/advisory/SFY20140805/citrix_nitro_sdk_xen_hotfix_page_is_vulnerable_to_cross_site_scripting.html · Exploit
• http://seclists.org/fulldisclosure/2015/Mar/128 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2839 · Nota
• http://securityfocus.com/archive/1/534935/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2839 · Nota de Segurança
• http://securityfocus.com/bid/73311 · Nota