Back to CVEs & Disclosures
HIGH — CVSS 7.5

Citrix Bleed Sensitive Information Disclosure

Buffer over-read vulnerability in Citrix NetScaler OpenID Connect implementation leaking memory chunks containing valid session tokens.

Status
Vendor Patched
Reported / Disclosed
2023

Impact

  • Leakage of unauthenticated active session cookies via crafted HTTP GET parameters.
  • Complete multi-factor authentication (MFA) bypass by replaying stolen session tokens.
  • Persistent authenticated access to corporate enterprise networks without password knowledge.

Timeline

  1. OCTOBER 10, 2023

    Citrix published security bulletin and patch guidance for NetScaler.

  2. OCTOBER 25, 2023

    Mandiant and CISA published advisories highlighting widespread session hijack campaigns.

aura~
Back to CVEs & Disclosures