CVE

Id
80115  
CVE No.
CVE-2015-2838  
Status
Candidate  
Description
Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.  
Phase
Assigned (20150403)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
725624 80115 CVE-2015-2838 BUGTRAQ:20150319 Command injection vulnerability in Citrix NITRO SDK xen_hotfix page  View
725625 80115 CVE-2015-2838 URL:http://www.securityfocus.com/archive/1/archive/1/534936/100/0/threaded  View
725626 80115 CVE-2015-2838 EXPLOIT-DB:36442  View
725627 80115 CVE-2015-2838 URL:https://www.exploit-db.com/exploits/36442/  View
725628 80115 CVE-2015-2838 FULLDISC:20150319 Command injection vulnerability in Citrix NITRO SDK xen_hotfix page  View
725629 80115 CVE-2015-2838 URL:http://seclists.org/fulldisclosure/2015/Mar/129  View
725630 80115 CVE-2015-2838 MISC:http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html  View
725631 80115 CVE-2015-2838 MISC:https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html  View
725632 80115 CVE-2015-2838 BID:73358  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
8653 JVNDB-2015-003973 複数の Dell デバイスのファームウェアの BIOS の実装における EFI フラッシュの攻撃を実行される脆弱性 複数の Dell デバイスのファームウェアの BIOS の実装は、スリープ状態から復帰させる保護メカニズムをロックする BIOS_CNTL を処理しないため、EFI フラッシュの攻撃を実行される脆弱性が存在します。 CVE-2015-2890 80115 7.2 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003973.html  View