CVE-2022-27518 - OpenCVE

Unauthenticated remote arbitrary code execution

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Citrix	Gateway Application Delivery Controller Firmware Gateway Firmware Application Delivery Controller

Configuration 1 [-]

AND

OR	cpe:2.3:o:citrix:application_delivery_controller_firmware:::::fips:::*
	cpe:2.3:o:citrix:application_delivery_controller_firmware:::::ndcpp:::*
	cpe:2.3:o:citrix:application_delivery_controller_firmware::::::::
	cpe:2.3:o:citrix:application_delivery_controller_firmware::::::::

cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:citrix:gateway_firmware::::::::
	cpe:2.3:o:citrix:gateway_firmware::::::::

cpe:2.3:h:citrix:gateway:-:*:*:*:*:*:*:*

References

Link	Resource
https://support.citrix.com/article/CTX474995	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Citrix

Published: 2022-12-13T00:00:00

Updated: 2023-10-18T17:34:17.110Z

Reserved: 2022-03-21T00:00:00

Link: CVE-2022-27518

JSON object: View

NVD Information

Status : Modified

Published: 2022-12-13T17:15:14.350

Modified: 2023-10-18T18:15:08.927

Link: CVE-2022-27518

JSON object: View

Redhat Information

No data.

CWE

{"cisaActionDue": "2023-01-03", "cisaExploitAdd": "2022-12-13", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:fips:*:*:*", "matchCriteriaId": "59CA6CB8-1B2C-4265-82ED-802D4D387EAD", "versionEndExcluding": "12.1-55.291", "versionStartIncluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:ndcpp:*:*:*", "matchCriteriaId": "0FB77A6C-768D-4084-924B-5F0607FE6D83", "versionEndExcluding": "12.1-55.291", "versionStartIncluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D0B760B-B3B6-442A-8C54-AA8A6D63660B", "versionEndExcluding": "12.1-65.25", "versionStartIncluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7EBF9BE3-E779-4621-8409-1A61DA07F6FF", "versionEndExcluding": "13.0-58.32", "versionStartIncluding": "13.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "80E69E10-6F40-4FE4-9D84-F6C25EAB79D8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB4301CB-EBF3-41D7-8A17-7E0B9E452780", "versionEndExcluding": "12.1-65.25", "versionStartIncluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD9F0308-2BD3-403F-B90E-EEB1B6845627", "versionEndExcluding": "13.0-58.32", "versionStartIncluding": "13.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:citrix:gateway:-:*:*:*:*:*:*:*", "matchCriteriaId": "3EF98B43-71DB-4230-B7AC-76EC2B1F0533", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Unauthenticated remote arbitrary code execution\n"}, {"lang": "es", "value": "Ejecuci\u00f3n remota de c\u00f3digo arbitrario no autenticado"}], "id": "CVE-2022-27518", "lastModified": "2023-10-18T18:15:08.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "secure@citrix.com", "type": "Secondary"}]}, "published": "2022-12-13T17:15:14.350", "references": [{"source": "secure@citrix.com", "tags": ["Vendor Advisory"], "url": "https://support.citrix.com/article/CTX474995"}], "sourceIdentifier": "secure@citrix.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-664"}], "source": "secure@citrix.com", "type": "Secondary"}]}