CVE-2024-8535

Authenticated user can access unintended user capabilities

State: Published
Severity: 5.8 Medium
Published: Nov 12, 2024
Updated: Nov 21, 2024
Reserved: Sep 6, 2024

Description

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources

Scores

CVSS	Score	Vector	Source
4.0	5.8 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H	Citrix

Weaknesses

CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
NetScaler ADCNetScaler	14.1 to before 29.72Affected 13.1 to before 55.34Affected 13.1 FIPS to before 37.207Affected 12.1-FIPS to before 55.321Affected 12.1-NDcPP to before 55.321Affected
NetScaler GatewayNetScaler	14.1 to before 29.72Affected 13.1 to before 55.34Affected 13.1-FIPS to before 37.207Affected 12.1-FIPS to before 55.321Affected 12.1-NDcPP to before 55.321Affected

References

https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.