CVE-2023-4966

🗓️ 10 Oct 2023 13:12:17Reported by CitrixType

cve🔗 web.nvd.nist.gov📰️ 39 Media mentions👁 1091 Views🌐 WEB

CVE-2023-4966 Sensitive information disclosure in NetScaler ADC and NetScaler Gatewa

Reporter	Title	Published	Views	Family All 67
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller	25 Oct 202312:37	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	5 Jul 202523:56	–	githubexploit
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller	29 Oct 202315:31	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	8 Jul 202514:12	–	githubexploit
GithubExploit	cve-deep-dives	16 Apr 202615:59	–	githubexploit
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller	25 Oct 202307:17	–	githubexploit
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller	27 Jan 202611:29	–	githubexploit
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller	25 Oct 202307:17	–	githubexploit
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller	29 Oct 202315:31	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	30 Jun 202511:02	–	githubexploit

NVD

Node

citrix netscaler_application_delivery_controllerRange12.1–12.1-55.300fips

citrix netscaler_application_delivery_controllerRange12.1–12.1-55.300ndcpp

citrix netscaler_application_delivery_controllerRange13.0–13.0-92.19-

citrix netscaler_application_delivery_controllerRange13.1–13.1-37.164fips

citrix netscaler_application_delivery_controllerRange13.1–13.1-49.15-

citrix netscaler_application_delivery_controllerRange14.1–14.1-8.50-

citrix netscaler_gatewayRange13.0–13.0-92.19

citrix netscaler_gatewayRange13.1–13.1-49.15

citrix netscaler_gatewayRange14.1–14.1-8.50

[
  {
    "defaultStatus": "unaffected",
    "product": "NetScaler ADC",
    "vendor": "Citrix",
    "versions": [
      {
        "lessThan": "8.50",
        "status": "affected",
        "version": "14.1",
        "versionType": "patch"
      },
      {
        "lessThan": "49.15",
        "status": "affected",
        "version": "13.1",
        "versionType": "patch"
      },
      {
        "lessThan": "92.19",
        "status": "affected",
        "version": "13.0",
        "versionType": "patch"
      },
      {
        "lessThan": "37.164",
        "status": "affected",
        "version": "13.1-FIPS",
        "versionType": "patch"
      },
      {
        "lessThan": "55.300",
        "status": "affected",
        "version": "12.1-FIPS",
        "versionType": "patch"
      },
      {
        "lessThan": "55.300",
        "status": "affected",
        "version": "12.1-NDcPP",
        "versionType": "patch"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NetScaler Gateway",
    "vendor": "Citrix",
    "versions": [
      {
        "lessThan": "8.50",
        "status": "affected",
        "version": "14.1",
        "versionType": "patch"
      },
      {
        "lessThan": "49.15",
        "status": "affected",
        "version": "13.1",
        "versionType": "patch"
      },
      {
        "lessThan": "92.19",
        "status": "affected",
        "version": "13.0",
        "versionType": "patch"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html
support	www.support.citrix.com/article/CTX579459
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
Cookie	header	logon/LogonPoint/Authentication/GetUserName	POST endpoint that, when supplied with a leaked session cookie via the Cookie header, can be used to map a cookie to a username, enabling token/session hijacking in the bleed flow	CWE-119

17 Jun 2026 06:38Current

8.6High risk

Vulners AI Score8.6

CVSS 3.17.5 - 9.4

EPSS0.99999

SSVC