PT-2024-8972 · Citrix · Citrix Netscaler Application Delivery Controller+1

Published 2024-11-12 · Updated 2024-12-19 · CVE-2024-8535

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway (affected versions not specified)

Description: The issue is related to a deviation from the expected behavior in the Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway. This can allow a remote attacker to gain unauthorized access to restricted functions. An authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance is configured as a Gateway with KCDAccount configuration for Kerberos SSO or as an Auth Server with KCDAccount configuration for Kerberos SSO to access backend resources.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Files Accessible to External Parties

Weakness Enumeration

CWE-284

CWE-440

CWE-552

Related Identifiers

BDU:2024-10654

CVE-2024-8535

Affected Products

Citrix Netscaler Application Delivery Controller

Citrix Netscaler Gateway

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2024-8535 · Security Note
• https://bdu.fstec.ru/vul/2024-10654 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8535 · Vendor Advisory
• https://twitter.com/XArthurDent/status/1856395506165133383 · Twitter Post
• https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US · Note
• https://twitter.com/CVEnew/status/1856409893470908443 · Twitter Post
• https://twitter.com/NetScaler/status/1857066085612159229 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1856346380702466435 · Twitter Post
• https://twitter.com/ripjyr/status/1856456434789319015 · Twitter Post
• https://twitter.com/Koetzing/status/1856360320349974803 · Twitter Post
• https://twitter.com/CyberPro_M/status/1869622606917423212 · Twitter Post
• https://t.me/cvenotify/101608 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024111301 · Note
• https://twitter.com/pravin_karthik/status/1856352340212887727 · Twitter Post
• https://twitter.com/AndrewScott_8/status/1856311663735050649 · Twitter Post