Vulnerability in Citrix Netscaler Application Delivery Controller
CVE-2019-6485
Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 allow remote attackers to obtain sensitive plaintext information because of a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.023 (82.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Citrix Netscaler_application_delivery_controller
- Citrix Netscaler_application_delivery_controller_firmware — versions 10.5, 11.0, 11.1
- Citrix Netscaler_gateway
- Citrix Netscaler_gateway_firmware — versions 10.5, 11.0, 11.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Patch, x_refsource_MISC, Mitigation, Vendor Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-6485?
- CVE-2019-6485 is a medium-severity vulnerability in Citrix Netscaler Application Delivery Controller, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 5.9/10. Published 2019-02-22.
- How severe is CVE-2019-6485?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2019-6485 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.