PT-2021-5216 · Citrix · Citrix Adc

Published 2021-10-09 · Updated 2021-12-08 · CVE-2021-22955

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Citrix ADC versions prior to 13.0-83.27 Citrix ADC versions prior to 12.1-63.22 Citrix ADC versions prior to 11.1-65.23

Description A denial of service vulnerability exists in Citrix ADC when configured as a VPN or AAA virtual server, allowing an attacker to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication. The vulnerability is related to an uncontrolled resource consumption issue, which can be exploited by a remote attacker to cause a denial of service on devices configured as a virtual VPN server.

Recommendations For versions prior to 13.0-83.27, update to a version that includes the fix for this issue. For versions prior to 12.1-63.22, update to a version that includes the fix for this issue. For versions prior to 11.1-65.23, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Management GUI, Nitro API, and RPC communication to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-06018

CVE-2021-22955

Affected Products

Citrix Adc

References · 7

• https://osv.dev/vulnerability/CVE-2021-22955 · Vendor Advisory
• https://support.citrix.com/article/CTX330728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22955 · Security Note
• https://bdu.fstec.ru/vul/2021-06018 · Security Note
• https://t.me/cibsecurity/33440 · Telegram Post
• https://t.me/isacarusec/4653 · Telegram Post
• https://t.me/true_secator/2312 · Telegram Post