VULNERABILITY INTELLIGENCE

CVE-2015-2838

CVSS score6.8 MEDIUM
EPSS probability2.86%
CISA KEVNot currently listed
Published2015-04-03
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references