CVE-2024-6235

Published Jul 10, 2024

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-6235 is a vulnerability affecting the NetScaler Console (formerly NetScaler ADM). This vulnerability, classified as an information disclosure issue, stems from improper authentication, which can allow unauthorized access to sensitive data. Specifically, it affects NetScaler Console version 14.1 before 14.1-25.53, as well as older versions 13.1 and 13.0. Successful exploitation of CVE-2024-6235 could lead to the disclosure of sensitive information, such as user credentials and configuration data. It is recommended to update NetScaler Console to the latest version to mitigate the risk.

Description: Sensitive information disclosure in NetScaler Console
Source: secure@citrix.com
NVD status: Analyzed

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-287

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_console:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D9A1C950-BACE-44C1-B0D5-F00F46D280F4",
            "versionEndExcluding": "14.1-25.53",
            "versionStartIncluding": "14.1-4.42"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.