CVE-2017-5933: citrix netscaler_application_delivery_controller

Vulnerability summary

CVE-2017-5933 is a medium (CVSS 5.9) vulnerability in citrix netscaler_application_delivery_controller. EPSS estimates a 3.18% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities.

Timeline

1. 08-02-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.