Improper control of a resource through its lifetime in Citrix Netscaler ADC and Citrix Access Gateway - CVE-2022-27518
Published: December 13, 2022
Vulnerability identifier: #VU70192
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-27518
CWE-ID: CWE-664
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper access restrictions in systems configured as a SAML SP or a SAML IdP. A remote non-authenticated attacker can gain unauthorized access to the system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Citrix Netscaler ADC
Citrix Access Gateway
Citrix Access Gateway
How to mitigate CVE-2022-27518
Install updates from vendor's website.
Citrix Netscaler ADC - addressed in versions 12.1-55.291, 12.1-65.25, 13.0-58.32
Citrix Access Gateway - addressed in versions 12.1-65.25, 13.0-58.32
Citrix Access Gateway - addressed in versions 12.1-65.25, 13.0-58.32