CVEvulnerability

CVE-2017-17549

5.9 MEDIUM Published 2017-12-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-12-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange.

Affected configurations

• citrix application delivery controller firmware 10.5 • citrix application delivery controller firmware 11.0 • citrix application delivery controller firmware 11.1 • citrix application delivery controller firmware 12.0 • citrix netscaler gateway firmware 10.5 • citrix netscaler gateway firmware 11.0 • citrix netscaler gateway firmware 11.1 • citrix netscaler gateway firmware 12.0

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References