Unscored severity · published Jan 14, 2011
CVE-2010-4566
The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access…
–
CVSS
27.8%
EPSS
No
On KEV
Description
The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0, allows attackers to execute arbitrary commands via shell metacharacters in the password field.
Exploitation
Is it being used?
Exploit prediction (EPSS)27.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Access Gateway · Citrix
through 9.2-49.8; .8.0; 8.0; 8.0; 8.0; 8.1-69.4; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4566
securityreason.com
http://securityreason.com/securityalert/8119
Vendor Advisory
http://support.citrix.com/article/CTX127613
www.exploit-db.com
http://www.exploit-db.com/exploits/16916
www.osvdb.org
http://www.osvdb.org/70099
www.securitytracker.com
http://www.securitytracker.com/id?1024893
www.vsecurity.com
http://www.vsecurity.com/resources/advisory/20101221-1
More from Access Gateway
–
CVE-2013-2263
Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors
–
CVE-2011-2883
The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to…
–
CVE-2011-2882
Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1…
–
CVE-2008-2528
Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain…
–
CVE-2007-0011
The web portal interface in Citrix Access Gateway (aka Citrix Advanced Access Control) before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows…