CVE-2023-4966 Helps Usher In A Baker’s Dozen Of Citrix Tags To Further Help Organizations Mitigate Harm | Grey Noise Blog
Summary: GreyNoise added detection tag coverage on October 23, 2023 for CVE-2023-4966, an information disclosure flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker hijack an existing authenticated session when the device is configured as a gateway or AAA virtual server. The two CVEs, published October 10, 2023, also include CVE-2023-4967, a denial-of-service vulnerability, and GreyNoise reported observing just under seventy IP addresses attempting exploitation, with activity starting on the 24th and showing no signs of stopping.
Bottom line: An unauthenticated attacker who hijacks an authenticated session inherits that account's permissions and can pull further credentials from the environment, and CISA has already added CVE-2023-4966 to its Known Exploited Vulnerabilities Catalog. Citrix has published no mitigation tips or workarounds, so patching to the listed versions is the only lever available.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-4966CVE-2023-4967
- Related
- Threat Brief: Citrix Bleed CVE-2023-4966 Cyber Risks ·CVE-2023-4966: Citrix Net Scaler ADC and Net Scaler Gateway Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Oct 18, 2023