Published: 03/04/2015 Updated: 09/10/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler prior to 10.5 build 52.3nc allows remote malicious users to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.

Vulnerable Product	Search on Vulmon	Subscribe to Product
citrix netscaler 10.5

Abstract Securify discovered a command injection vulnerability in xen_hotfix page of the NITRO SDK The attacker-supplied command is executed with elevated privileges (nsroot) This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data Tested version This issue was discovered in Citrix Net ...

CWE-352 http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html http://seclists.org/fulldisclosure/2015/Mar/129 https://www.exploit-db.com/exploits/36442/http://www.securityfocus.com/bid/73358 http://www.securityfocus.com/archive/1/534936/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/36442/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-2838

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect