Detections
Analytics

Citrix Gateway / ADC Cross-Site Scripting

medium Web App Scanning Plugin ID 113971

Language:

Synopsis

Citrix Gateway / ADC Cross-Site Scripting

Description

Citrix ADC and Gateway 13.1-x < 13.1-45.61, 13.0-x < 13.0-90.11, 12.1-x < 12.1-65.35 and ADC 12.1-x (FIPS/NDcPP) < 12.1-55.296 suffer from a lack of sanitization of the URL query parameters which can lead to an open redirect and a cross-site scripting vulnerability. By crafting a specific URL, a remote and unauthenticated attacker can leverage this vulnerability to execute malicious JavaScript code in the context of the victim browser.

Solution

Upgrade to Citrix ADC or Gateway 12.1-65.35, 13.0-90.11, 13.1-45-61 or latest. For FIPS / NDcPP versions, upgrade to version 12.1-55.296 or latest.

See Also

https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488

Plugin Details

Severity: Medium

ID: 113971

Type: remote

Published: 7/13/2023

Updated: 7/24/2023

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 3.8

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2023-24488

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS Score Source: CVE-2023-24488

Vulnerability Information

CPE: cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/9/2023

Vulnerability Publication Date: 5/9/2023

Reference Information

CVE: CVE-2023-24488