Citrix Issues Patches for Critical Flaw Affecting ADC and Gateway Products

Citrix has released security updates to deal with a critical authentication bypass flaw in the software delivery controller (ADC) and Gateway solutions that could be exploited to just take management of afflicted techniques.

Profitable exploitation of the issues could permit an adversary to acquire licensed obtain, carry out remote desktop takeover, and even circumvent defenses against login brute-power attempts under distinct configurations.

• CVE-2022-27510 – Unauthorized accessibility to Gateway consumer abilities
• CVE-2022-27513 – Remote desktop takeover by means of phishing
• CVE-2022-27516 – User login brute-power security performance bypass

The following supported variations of Citrix ADC and Citrix Gateway are influenced by the flaws –

• Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
• Citrix ADC and Citrix Gateway 13. right before 13.-88.12
• Citrix ADC and Citrix Gateway 12.1 ahead of 12.1.65.21
• Citrix ADC 12.1-FIPS just before 12.1-55.289
• Citrix ADC 12.1-NDcPP right before 12.1-55.289

Exploitation, nonetheless, financial institutions on the prerequisite that the appliances are both configured as a VPN (Gateway) or, alternatively, an authentication, authorization and accounting (AAA) digital server in the case of CVE-2022-27516.

1 leading of that, CVE-2022-27513 and CVE-2022-27516 also use only when the RDP proxy aspect and the user lockout operation “Max Login Makes an attempt” are set up, respectively.

The cloud computing and virtualization technology business reported that no motion is required from buyers relying on cloud expert services managed instantly by Citrix.

Jarosław Jahrek Kamiński, a researcher at Polish penetration testing company Securitum, has been credited with finding and reporting the vulnerabilities.

“Afflicted shoppers of Citrix ADC and Citrix Gateway are proposed to put in the appropriate up to date versions of Citrix ADC or Citrix Gateway as quickly as attainable,” Citrix explained in an advisory.

Located this posting appealing? Comply with THN on Fb, Twitter  and LinkedIn to read more exclusive written content we write-up.

Some parts of this article are sourced from:
thehackernews.com