NVD

Id
24818  
Name
CVE-2015-2838  
Description
Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-04-03  
Modified Date
2016-12-02  
Seq
2015-2838  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
131058 24818 CVE-2015-2838 http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html  View
131059 24818 CVE-2015-2838 20150319 Command injection vulnerability in Citrix NITRO SDK xen_hotfix page  View
131060 24818 CVE-2015-2838 20150319 Command injection vulnerability in Citrix NITRO SDK xen_hotfix page  View
131061 24818 CVE-2015-2838 73358  View
131062 24818 CVE-2015-2838 36442  View
131063 24818 CVE-2015-2838 https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6760 JVNDB-2015-002080 Citrix NetScaler の Nitro API におけるクロスサイトリクエストフォージェリの脆弱性 Citrix NetScaler の Nitro API には、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2015-2838 80063 CVE-2015-2838 24818 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002080.html 2015-03-19 2015-04-07 View