CVE-2019-6485

Опубликовано: 22 фев. 2019

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 allow remote attackers to obtain sensitive plaintext information because of a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled.

Ссылки

http://www.securityfocus.com/bid/106783
Third Party Advisory
VDB Entry
https://github.com/RUB-NDS/TLS-Padding-Oracles
Product
Third Party Advisory
https://support.citrix.com/article/CTX240139
Mitigation
Patch
Vendor Advisory
http://www.securityfocus.com/bid/106783
Third Party Advisory
VDB Entry
https://github.com/RUB-NDS/TLS-Padding-Oracles
Product
Third Party Advisory
https://support.citrix.com/article/CTX240139
Mitigation
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:citrix:netscaler_gateway_firmware:10.5:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_gateway_firmware:11.0:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_gateway_firmware:11.1:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_gateway_firmware:12.0:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_gateway_firmware:12.1:*:*:*:*:*:*:*

cpe:2.3:h:citrix:netscaler_gateway:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

Одно из

cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:10.5:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:11.0:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:11.1:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:12.0:*:*:*:*:*:*:*

cpe:2.3:o:citrix:netscaler_application_delivery_controller_firmware:12.1:*:*:*:*:*:*:*

cpe:2.3:h:citrix:netscaler_application_delivery_controller:-:*:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00463

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-327

Связанные уязвимости

GHSA-759j-f46v-ghhc