CVE-2015-2838

Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
citrixnetscaler
10.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/129
http://www.securityfocus.com/archive/1/534936/100/0/threaded
http://www.securityfocus.com/bid/73358
https://www.exploit-db.com/exploits/36442/
https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html
http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/129
http://www.securityfocus.com/archive/1/534936/100/0/threaded
http://www.securityfocus.com/bid/73358
https://www.exploit-db.com/exploits/36442/
https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html