CVE-2015-2838: Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication…

PriorityP341medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EXPLOIT

EPSS

2.88%

85.1th percentile

Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
citrix	netscaler	—	—
citrix	netscaler_adc_gateway	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.