Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-2841 — Improper Access Control in Citrix Netscaler

CWE-284 — Improper Access Control4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
4.4%
top 10.97%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Citrix NetscalerCitrix Netscaler ADC Gateway
Timeline
PublishedApr 3
Latest updateMay 17

Description

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

🔴Vulnerability Details

1
GHSA
GHSA-h3fj-247x-cqr8: Citrix NetScaler AppFirewall, as used in NetScaler 10↗2022-05-17
▶

💥Exploits & PoCs

1
Exploit-DB
Citrix Netscaler NS10.5 - WAF Bypass (Via HTTP Header Pollution)↗2015-03-12
▶

📋Vendor Advisories

1
Citrix
CVE-2015-2841: Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type h↗2015-04-03
▶