CVE-2024-8535

Published: Nov 12, 2024Modified: Jun 17, 2026

5.8

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: secure@citrix.com (Secondary)

Description

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources

Affected (7)

Products: Citrix: Netscaler Application Delivery Controller, Netscaler Gateway

Citrix

2 products

Netscaler Application Delivery Controller

Netscaler Gateway

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Citrix Netscaler Application Delivery Controller	From 12.1 to 13.1-55.34
Citrix Netscaler Application Delivery Controller	From 14.1 to 14.1-29.72
Citrix Netscaler Application Delivery Controller	From 12.1 to 12.1-55.321
Citrix Netscaler Application Delivery Controller	From 13.1 to 13.1-37.207
Citrix Netscaler Application Delivery Controller	From 12.1 to 12.1-55.321
Citrix Netscaler Gateway	From 12.1 to 13.1-55.34
Citrix Netscaler Gateway	From 14.1 to 14.1-29.72

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (1)

https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US

Source: secure@citrix.com

Vendor Advisory

Timeline

No history available yet.