Actively exploited · Published Jul 19, 2023 · Assigned by Citrix
CVE-2023-3519
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity code injection in NetScaler ADC from Citrix. Attackers are actively exploiting it in the wild (listed by CISA on July 19, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 9, 2023.
Official description
Unauthenticated remote code execution
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Citrix | NetScaler ADC | 13.1 – before 49.1313.0 – before 91.1313.1-FIPS – before 37.15912.1-FIPS – before 55.29712.1-NDcPP – before 55.297 |
| Citrix | NetScaler Gateway | 13.1 – before 49.1313.0 – before 91.13 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
- http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3519 government-resource