CERT-In Vulnerability Note
CIVN-2022-0473
Remote Code Execution Vulnerability in Citrix Products
Original Issue Date:December 15, 2022
Severity Rating: CRITICAL
Software Affected
- Citrix ADC and Citrix Gateway 13.0 before 13.0-58.32
- Citrix ADC and Citrix Gateway 12.1 before 12.1-65.25
- Citrix ADC 12.1-FIPS before 12.1-55.291
- Citrix ADC 12.1-NDcPP before 12.1-55.291
Overview
A vulnerability exists in Citrix Gateway and Citrix ADC which could allow an unauthenticated remote attacker to execute arbitrary code on the targeted system.
Description
This vulnerability exists in Citrix Gateway and Citrix ADC due to improper control of a resource through its lifetime. An attacker could exploit this vulnerability by sending a specially-crafted request to the affected system.
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the targeted system.
Note: It has been reported that the vulnerability is exploited in the wild.
Solution
Updates are available to download for Citrix ADC and
Citrix Gateway
.
Vendor Information
Citrix
https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227518
References
Citrix
https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227518
CVE Name
CVE-2022-27518
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|