Unscored severity · published Apr 3, 2015
CVE-2015-2838
Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
NetScaler ADC · Citrix
10.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2838
Exploit
http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html
seclists.org
http://seclists.org/fulldisclosure/2015/Mar/129
www.securityfocus.com
http://www.securityfocus.com/archive/1/534936/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/73358
www.exploit-db.com
https://www.exploit-db.com/exploits/36442/
Exploit
https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html
More from NetScaler ADC
9.8
CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service