1. Home
  2. CVE Database
  3. CVE-2024-8535
HIGH · 8.1

CVE-2024-8535

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount...

Vulnerability Description

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CitrixNetscaler Application Delivery Controller>= 12.1, < 12.1-55.321
CitrixNetscaler Gateway>= 12.1, < 13.1-55.34

Related Weaknesses (CWE)

CWE-552

References

FAQ

What is CVE-2024-8535?

CVE-2024-8535 is a vulnerability with a CVSS score of 8.1 (HIGH). Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount...

How severe is CVE-2024-8535?

CVE-2024-8535 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-8535?

Check the references section above for vendor advisories and patch information. Affected products include: Citrix Netscaler Application Delivery Controller, Citrix Netscaler Gateway.