CVEvulnerability

CVE-2019-6485

5.9 MEDIUM Published 2019-02-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-02-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-327

Description

Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 allow remote attackers to obtain sensitive plaintext information because of a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled.

Affected configurations

• citrix netscaler gateway firmware 10.5 • citrix netscaler gateway firmware 11.0 • citrix netscaler gateway firmware 11.1 • citrix netscaler gateway firmware 12.0 • citrix netscaler gateway firmware 12.1 • citrix netscaler application delivery controller firmware 10.5 • citrix netscaler application delivery controller firmware 11.0 • citrix netscaler application delivery controller firmware 11.1 • citrix netscaler application delivery controller firmware 12.0 • citrix netscaler application delivery controller firmware 12.1

Related

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References