Vulnerabilities > CVE-2016-9028 - 7PK - Security Features vulnerability in Citrix Netscaler Application Delivery Controller Firmware

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

citrix

CWE-254

NVD

Published: 2016-10-28

Updated: 2017-07-29

Summary

Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header.

Vulnerable Configurations

Part	Description	Count
OS	Citrix Citrix Netscaler Application Delivery Controller Firmware 9.2 Citrix Netscaler Application Delivery Controller Firmware 9.3 Citrix Netscaler Application Delivery Controller Firmware 9.3\(1\) Citrix Netscaler Application Delivery Controller Firmware 9.3.E Citrix Netscaler Application Delivery Controller Firmware 10.0 Citrix Netscaler Application Delivery Controller Firmware 10.0.E Citrix Netscaler Application Delivery Controller Firmware 10.1 Citrix Netscaler Application Delivery Controller Firmware 10.5 Citrix Netscaler Application Delivery Controller Firmware 11.0 Citrix Netscaler Application Delivery Controller Firmware 11.1	10
Hardware	Citrix Citrix Netscaler Application Delivery Controller -	1

Common Weakness Enumeration (CWE)

CWE-254 - 7PK - Security Features

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References