This message was deleted.
# citrix-netscalers
Slackbot
05/09/2023, 1:37 PMThis message was deleted.
😄 1
😑 1
🙁 4
💩 2
n
Neal Dolson
05/09/2023, 2:26 PMDang, right after we upgraded 1 of our sites to the latest (at the time) 13.0 builds.
Neal Dolson
05/10/2023, 9:31 PMI am a little bit unclear as to the severity of this disclosure, obviously CVSS score of 6.1 is much lower than some of the 9.x+ vulns we've seen in the past, but the CTX article doesn't say much other than it's a cross site scripting exploit. Even searching twitter/security blogs for info doesn't return much. In a perfect world we'd all upgrade our stuff the day disclosures happen but in the real world, it's gonna take us a couple weekends to make it there most likely.
j
Jan Tytgat
05/10/2023, 10:24 PMWe consider the threat as medium, so no rush to go and deploy today. But I would not delay the upgrade longer than necessary.
We all know how much time it takes sometimes to get the customers involved and get approval, so you might look at a week delay anyway.
e
Eirik Vesterhus / Intility AS
05/11/2023, 4:37 AMI am very interested in some more details regarding pre-requisites for CVE-2023-24488. For example - Does it require that the threat actor be authenticated and logged in to the AAA/Gateway-vserver first.
j
Jan Tytgat
05/11/2023, 8:34 AMNo, you just need the feature enabled and in use. The XSS is probably related to the web interface presented during login attempts.
Jan Tytgat
05/11/2023, 8:35 AM(At least, that’s what we know until know as no further details are available)
e
Eirik Vesterhus / Intility AS
05/11/2023, 8:37 AMYep.
2 Views