CVEs / CVE-2023-4966
CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- Known exploited in the CISA KEV catalog since 18 Oct 2023
- high 7.5 CVSS 3.1 (NVD)
- EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2023-4966
Summary
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Description
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Citrix NetScaler ADC | from 14.1, before 8.50 | 8.50 |
| Citrix NetScaler ADC | from 13.1, before 49.15 | 49.15 |
| Citrix NetScaler ADC | from 13.0, before 92.19 | 92.19 |
| Citrix NetScaler ADC | from 13.1-FIPS, before 37.164 | 37.164 |
| Citrix NetScaler ADC | from 12.1-FIPS, before 55.300 | 55.300 |
| Citrix NetScaler ADC | from 12.1-NDcPP, before 55.300 | 55.300 |
| Citrix NetScaler Gateway | from 14.1, before 8.50 | 8.50 |
| Citrix NetScaler Gateway | from 13.1, before 49.15 | 49.15 |
| Citrix NetScaler Gateway | from 13.0, before 92.19 | 92.19 |
Exploitation
| In CISA KEV since | 18 Oct 2023 |
|---|---|
| Due date for US federal agencies | 8 Nov 2023 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NScored by NVD |
|---|---|
| Weakness | CWE-119 |
References
- CVE-2023-4966 on NVD
- CVE-2023-4966 in the CISA KEV catalog
- https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/ (cited by CISA)
- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967 (cited by CISA)
- http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html Third Party Advisory, VDB Entry
- https://support.citrix.com/article/CTX579459 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.