CVE-2024-2049

Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CitrixCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
citrixsd-wan_1000_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_110_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_1100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_2000_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_210_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_2100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_400_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_4000_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_410_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_4100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_5100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_6100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_1000_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_1100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_2000_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_2100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_6100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
citrixsd-wan_5100_firmware
11.4.0 ≤
𝑥
< 11.4.4.46
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049
https://support.citrix.com/external/article?articleUrl=CTX617071-citrix-sdwan-security-bulletin-for-cve20242049&language=en_US
https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049