Medium severity · published Jun 25, 2009
CVE-2009-2213
The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow…
6.5
CVSS
2%
EPSS
No
On KEV
Description
The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netscaler Access Gateway · Citrix
All versions, or not specified · source: NVD
NA
Netscaler Access Gateway Firmware · Citrix
through 8.1; 7.0; 8.0; 9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2213
Broken Link
http://support.citrix.com/article/CTX118770
Broken Link
http://www.securityfocus.com/bid/35422
Permissions Required
http://www.vupen.com/english/advisories/2009/1641
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51274
More from Netscaler Access Gateway
–
CVE-2014-4347
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x before 10.1-126.12 allows…
–
CVE-2014-4346
Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway…
–
CVE-2014-1899
Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows…
–
CVE-2014-2882
Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has…
–
CVE-2014-2881
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and…