XSS in Citrix Netscaler
CVE-2015-2839
The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.020 (79.3th percentile) — read the EPSS interpretation.
Affected products
- Citrix Netscaler — versions 10.5
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_BID)