Skip to main content

Two vulnerabilities could lead to sensitive information disclosure or DoS

Threat ID:CC-4521
Threat Severity:Medium
Published:10 July 2024 1:43 PM

Summary

Two vulnerabilities could lead to sensitive information disclosure or DoS 

Affected platforms

The following platforms are known to be affected:

NetScaler
  • NetScaler Console 14.1 prior to 14.1-25.53
  • NetScaler Console 13.1 prior to 13.1-53.22
  • NetScaler Console 13.0 prior to 13.0-92.31
  • NetScaler SVM 14.1 prior to 14.1-25.53
  • NetScaler SVM 13.1 prior to 13.1-53.17
  • NetScaler SVM 13.0 prior to 13.0-92.31
  • NetScaler Agent 14.1 prior to 14.1-25.53
  • NetScaler Agent 13.1 before 13.1-53.22
  • NetScaler Agent 13.0 before 13.0-92.31

Threat details

Citrix-managed instances do not need further action

Only customer-managed NetScaler Console instances are vulnerable. Customers using Citrix-managed NetScaler Console Service do not need to take any action.


Introduction

Citrix has released a critical security bulletin addressing two vulnerabilities affecting NetScaler Console, NetScaler Agent, and NetScaler SVM.

  • CVE-2024-6235, an improper authentication vulnerability, has a CVSSv4 score of 9.4 and could lead to sensitive information disclosure if the attacker was able to gain access to the NetScaler Console IP.
  • CVE-2024-6236, a denial-of-service (DoS) vulnerability, has a CVSSv4 score of 7.1 and could be achieved if an attacker was able to gain access to NetScaler Console IP, NetScaler Agent IP, or SVM IP.

Remediation advice

Affected organisations are encouraged to review Citrix Security Bulletin CTX677998 and apply the relevant updates.

Definitive source of threat updates

CVE Vulnerabilities

StatusReserved
CVE-2024-6235
StatusReserved
CVE-2024-6236

Last edited: 10 July 2024 2:01 pm

Back to top