9.8 - CVE-2019-19781

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2019-19781	First vendor Publication	2019-12-27
Vendor	Cve	Last vendor Modification	2025-04-03

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score	9.8
Base Score	9.8	Environmental Score	9.8
impact SubScore	5.9	Temporal Score	9.8
Exploitabality Sub Score	3.9

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	None
Scope	Unchanged	Confidentiality Impact	High
Integrity Impact	High	Availability Impact	High
Calculate full CVSS 3.0 Vectors scores

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

%	Id	Name
100 %	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

Type	Description	Count
Os	Citrix Application Delivery Controller Firmware cpe:2.3:o:citrix:application_delivery_controller_firmware:13.0:::::::* cpe:2.3:o:citrix:application_delivery_controller_firmware:12.1:::::::* cpe:2.3:o:citrix:application_delivery_controller_firmware:12.0:::::::* cpe:2.3:o:citrix:application_delivery_controller_firmware:11.1:::::::* cpe:2.3:o:citrix:application_delivery_controller_firmware:10.5:::::::*	5
Os	Citrix Gateway Firmware cpe:2.3:o:citrix:gateway_firmware:13.0:::::::*	1
Os	Citrix Netscaler Gateway Firmware cpe:2.3:o:citrix:netscaler_gateway_firmware:12.1:::::::* cpe:2.3:o:citrix:netscaler_gateway_firmware:12.0:::::::* cpe:2.3:o:citrix:netscaler_gateway_firmware:11.1:::::::* cpe:2.3:o:citrix:netscaler_gateway_firmware:10.5:::::::*	4

Description	Link
Citrix ADC and Gateway directory traversal and XML file upload	More info here

Date	Description
2020-02-25	Citrix ADC and Gateway backdoor upload attempt RuleID : 52662 - Revision : 1 - Type : MALWARE-OTHER
2020-01-17	Citrix ADC and Gateway arbitrary code execution attempt RuleID : 52620-community - Revision : 2 - Type : SERVER-WEBAPP
2020-02-18	Citrix ADC and Gateway arbitrary code execution attempt RuleID : 52620 - Revision : 2 - Type : SERVER-WEBAPP
2020-02-13	Citrix ADC and Gateway arbitrary code execution attempt RuleID : 52603 - Revision : 1 - Type : SERVER-WEBAPP
2020-01-28	Citrix ADC and Gateway arbitrary code execution attempt RuleID : 52513 - Revision : 2 - Type : SERVER-WEBAPP
2020-01-28	Citrix ADC and Gateway arbitrary code execution attempt RuleID : 52512 - Revision : 2 - Type : SERVER-WEBAPP
2020-12-05	Citrix ADC and Gateway arbitrary code execution attempt RuleID : 300001 - Revision : 1 - Type : SERVER-WEBAPP

id	Description
2019-12-17	Citrix ADC (NetScaler) Directory Traversal Scanner
2019-12-17	Citrix ADC (NetScaler) Directory Traversal RCE
2019-12-17	Citrix ADC (NetScaler) Directory Traversal RCE

Source	Url

If you want to see full details history, please login or register.