CVE-2015-2839 The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks v...
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citrix netscaler | = 10.5 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150319 Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting mailing-list
- 20150319 Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting mailing-list
- 73311 vdb-entry
- www.securify.nl exploit