Netscaler

Vendor:

First CVE: Nov 20, 2007 · Active for 18 years

12

Total CVEs

More Total CVEs than 90% of tracked products

2.4

Avg CVEs / Year

Higher CVE frequency than 74% of tracked products

6.2

Avg CVSS

Higher Avg CVSS than 24% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Netscaler over time

Volume of CVEsAvg CVSS Base Score

First CVE

Nov 20, 2007

18 years ago

Most Recent CVE

Jan 2, 2020

2,396 days ago

CVE Severity & Scoring

Netscaler12 CVEs

67%

25%

8%

All CVEs352,708 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network5 (41.7%)

Unknown7 (58.3%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low4 (33.3%)

High1 (8.3%)

Unknown7 (58.3%)

User Interaction

None4 (33.3%)

Unknown7 (58.3%)

Required1 (8.3%)

Privileges Required

Low1 (8.3%)

High0 (0.0%)

None4 (33.3%)

Unknown7 (58.3%)

Top CVEs

Signals from CVEs in this product scope (12 CVEs).

12 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2013-3619HIGH Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards be	Jan 2, 2020	8.1	34	NO	YES
CVE-2016-2071CRITICAL Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allows re	Feb 17, 2016	9.8	31	NO	NO
CVE-2015-2841MEDIUM Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the	Apr 3, 2015	5.0	30	NO	YES
CVE-2018-6186HIGH Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attacker can gain access to	Feb 1, 2018	8.8	28	NO	NO
CVE-2015-2838MEDIUM Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for	Apr 3, 2015	6.8	27	NO	YES
CVE-2007-6037MEDIUM Cross-site scripting (XSS) vulnerability in ws/generic_api_call.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standal	Nov 20, 2007	4.3	22	NO	YES
CVE-2013-3620HIGH Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Su	Jan 2, 2020	7.5	20	NO	NO
CVE-2016-2072MEDIUM The Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, 10.5.e	Feb 17, 2016	6.1	19	NO	NO
CVE-2015-2840MEDIUM Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML vi	Apr 3, 2015	4.3	15	NO	NO
CVE-2007-6193MEDIUM The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network c	Nov 30, 2007	5.0	15	NO	NO

View all 12 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (12 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

1 CVE

8.3% of CVEs· 97th percentile

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

3 CVEs

25.0% of CVEs· 90th percentile

Social Chatter

Signals from CVEs in this product scope (12 CVEs).

Media Mentions

Signals from CVEs in this product scope (12 CVEs).

Top CNAs Publishing CVEs For Netscaler

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
8.0_build_47.8	1	4.3	3.6%	1
8.0	2	4.7	0.9%	0
12.0	1	8.8	3.1%	0
11.0	2	8.0	2.2%	0
10.5e	2	8.0	2.2%	0
10.5	6	6.5	2.6%	2
10.1	1	6.1	1.1%	0