Vulnerabilities > CVE-2016-9028 - 7PK - Security Features vulnerability in Citrix Netscaler Application Delivery Controller Firmware

CVSS 5.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

NONE

network

citrix

CWE-254

NVD

Published: 2016-10-28

Updated: 2017-07-29

Summary

Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header.

Vulnerable Configurations

Part	Description	Count
OS	Citrix Citrix Netscaler Application Delivery Controller Firmware 9.2 Citrix Netscaler Application Delivery Controller Firmware 9.3 Citrix Netscaler Application Delivery Controller Firmware 9.3\(1\) Citrix Netscaler Application Delivery Controller Firmware 9.3.E Citrix Netscaler Application Delivery Controller Firmware 10.0 Citrix Netscaler Application Delivery Controller Firmware 10.0.E Citrix Netscaler Application Delivery Controller Firmware 10.1 Citrix Netscaler Application Delivery Controller Firmware 10.5 Citrix Netscaler Application Delivery Controller Firmware 11.0 Citrix Netscaler Application Delivery Controller Firmware 11.1	10
Hardware	Citrix Citrix Netscaler Application Delivery Controller -	1

Common Weakness Enumeration (CWE)

CWE-254 - 7PK - Security Features

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References