Lucene search

K
attackerkbAttackerKBAKB:AFC76977-D355-470D-A7F6-FEF7A8352B65
HistoryNov 05, 2019 - 12:00 a.m.

CVE-2019-19781

2019-11-0500:00:00
attackerkb.com
83

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Recent assessments:

kevthehermit at February 22, 2020 12:29am UTC reported:

AWS had pre built AMIs for these appliances built and supplied to the market place by Citrix.

At the time of release and for several weeks afterwards, they were still available in their default vulnerable state. Whilst AWS have removed the vulnerable images any AWS account that subscribed to a specific AMI will still have the default vulnerable version.

If you use this kind of setup it is important to remove any old AMIs and replace them, do not assume that patches will be applied to exising AMIs

zeroSteiner at January 02, 2020 3:42pm UTC reported:

AWS had pre built AMIs for these appliances built and supplied to the market place by Citrix.

At the time of release and for several weeks afterwards, they were still available in their default vulnerable state. Whilst AWS have removed the vulnerable images any AWS account that subscribed to a specific AMI will still have the default vulnerable version.

If you use this kind of setup it is important to remove any old AMIs and replace them, do not assume that patches will be applied to exising AMIs

dmelcher5151 at April 16, 2020 12:56am UTC reported:

AWS had pre built AMIs for these appliances built and supplied to the market place by Citrix.

At the time of release and for several weeks afterwards, they were still available in their default vulnerable state. Whilst AWS have removed the vulnerable images any AWS account that subscribed to a specific AMI will still have the default vulnerable version.

If you use this kind of setup it is important to remove any old AMIs and replace them, do not assume that patches will be applied to exising AMIs

bcook-r7 at January 11, 2020 7:23pm UTC reported:

AWS had pre built AMIs for these appliances built and supplied to the market place by Citrix.

At the time of release and for several weeks afterwards, they were still available in their default vulnerable state. Whilst AWS have removed the vulnerable images any AWS account that subscribed to a specific AMI will still have the default vulnerable version.

If you use this kind of setup it is important to remove any old AMIs and replace them, do not assume that patches will be applied to exising AMIs

hrbrmstr at May 12, 2020 7:56pm UTC reported:

AWS had pre built AMIs for these appliances built and supplied to the market place by Citrix.

At the time of release and for several weeks afterwards, they were still available in their default vulnerable state. Whilst AWS have removed the vulnerable images any AWS account that subscribed to a specific AMI will still have the default vulnerable version.

If you use this kind of setup it is important to remove any old AMIs and replace them, do not assume that patches will be applied to exising AMIs

gwillcox-r7 at October 20, 2020 5:51pm UTC reported:

AWS had pre built AMIs for these appliances built and supplied to the market place by Citrix.

At the time of release and for several weeks afterwards, they were still available in their default vulnerable state. Whilst AWS have removed the vulnerable images any AWS account that subscribed to a specific AMI will still have the default vulnerable version.

If you use this kind of setup it is important to remove any old AMIs and replace them, do not assume that patches will be applied to exising AMIs

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5

References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%