Citrix Releases Security Fix for NetScaler Console Privilege Escalation Vulnerability

Avatar
Citrix has released security updates for a high-severity security flaw impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent that could lead to privilege escalation under certain conditions. The vulnerability, tracked as CVE-2024-12284, has been given a CVSS v4 score of 8.8 out of a maximum of 10.0 It has been described as a case of improper privilege management that could
[[{“value”:”

Citrix has released security updates for a high-severity security flaw impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent that could lead to privilege escalation under certain conditions.

The vulnerability, tracked as CVE-2024-12284, has been given a CVSS v4 score of 8.8 out of a maximum of 10.0

It has been described as a case of improper privilege management that could result in authenticated privilege escalation if the NetScaler Console Agent is deployed and allows an attacker to execute post-compromise actions.

“The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization,” Netscaler noted.

“However, only authenticated users with existing access to the NetScaler Console can exploit this vulnerability, thereby limiting the threat surface to only authenticated users.”

The shortcoming affects the below versions –

NetScaler Console 14.1 before 14.1-38.53
NetScaler Console 13.1 before 13.1-56.18
NetScaler Agent 14.1 before 14.1-38.53
NetScaler Agent 13.1 before 13.1-56.18

It has been remediated in the below versions of the software –

NetScaler Console 14.1-38.53 and later releases
NetScaler Console 13.1-56.18 and later releases of 13.1
NetScaler Agent 14.1-38.53 and later releases
NetScaler Agent 13.1-56.18 and later releases of 13.1

“Cloud Software Group strongly urges customers of NetScaler Console and NetScaler Agent to install the relevant updated versions as soon as possible,” the company said, adding there are no workarounds to resolve the flaw.

That said, customers who are using Citrix-managed NetScaler Console Service do not need to take any action.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

“}]] The Hacker News 

Total
0
Shares
Previous Post

Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability

Next Post

Microsoft’s End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now

Related Posts

OAuth Redirect Flaw in Airline Travel Integration Exposes Millions to Account Hijacking

Cybersecurity researchers have disclosed details of a now-patched account takeover vulnerability affecting a popular online travel service for hotel and car rentals. "By exploiting this flaw, attackers can gain unauthorized access to any user’s account within the system, effectively allowing them to impersonate the victim and perform an array of actions on their behalf – including
Avatar
Read More

RANsacked: Over 100 Security Flaws Found in LTE and 5G Network Implementations

A group of academics has disclosed details of over 100 security vulnerabilities impacting LTE and 5G implementations that could be exploited by an attacker to disrupt access to service and even gain a foothold into the cellular core network. The 119 vulnerabilities, assigned 97 unique CVE identifiers, span seven LTE implementations – Open5GS, Magma, OpenAirInterface, Athonet, SD-Core, NextEPC,
Avatar
Read More