Warning: Authentication Bypass Vulnerability in CITRIX ADC and Gateway
CVE-2022-27510 (CVSSv3 : 9.8/10)
Bronnen
Risico’s
Citrix has released security updates to address a critical authentication bypass vulnerability, CVE-2022-27510, affecting Citrix ADC and Citrix Gateway. A remote attacker could exploit this vulnerability to bypass authentication and acquire access to Gateway user capabilities by using an alternate path or channel.
This vulnerability is of low complexity and does not requires user interaction. In addition, this flaw could have a high impact on confidentiality, integrity and availability.
Beschrijving
This authentication bypass vulnerability using an alternate path or channel can only be exploited by an attacker if the appliance is set up as secure socket layer virtual private network (SSL VPN). Authentication bypass vulnerabilities like this one could be exploited by an attacker as an initial access vector into a network.
Aanbevolen acties
The CCB recommends customer-managed Citrix ADC and Citrix Gateway appliances to install updated versions with the highest priority, after thorough testing. Detailed instructions can be found on: Citrix security bulletin.
Citrix notes that, customers using Citrix-managed cloud services do not need to take any action.