CVE-2019-18177

Published: Dec 26, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citrix ADC and Citrix Gateway 13.0-58.30 and later releases before the CTX276688 update.

Affected (2)

Products: Citrix: Application Delivery Controller Firmware, Gateway

Citrix

2 products

Application Delivery Controller Firmware

Gateway

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Citrix Application Delivery Controller Firmware	Before 13.0-58.30

Running on/with	Platform Versions
Citrix Application Delivery Controller	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Citrix Gateway	Before 13.0-58.30

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://support.citrix.com/article/CTX276688/citrix-application-delivery-controller-citrix-gateway-and-citrix-sdwan-wanop-appliance-security-update

Source: cve@mitre.org

Vendor Advisory

https://support.citrix.com/article/CTX276688/citrix-application-delivery-controller-citrix-gateway-and-citrix-sdwan-wanop-appliance-security-update

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.