Citrix Releases Security Updates for Citrix ADC and Citrix Gateway

Security update addresses three vulnerabilities affecting Citrix ADC and Citrix Gateway

Threat ID:: CC-4212
Threat Severity:: Information only
Published:: 9 November 2022 1:13 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses three vulnerabilities affecting Citrix ADC and Citrix Gateway

Affected platforms

The following platforms are known to be affected:

Versions: 13.1 all prior  to 13.1-33.47, 13.0  all prior to 13.0-88.12, 12.1 all prior  to 12.1.65.21

Citrix Gateway

Versions: 13.1 all prior  to 13.1-33.47, 13.0  all prior  to 13.0-88.12, 12.1 all prior  to 12.1.65.21, 12.1-FIPS all prior to 12.1-55.289, 12.1-NDcPP all prior  to 12.1-55.289

Citrix ADC

Threat details

Introduction

Citrix has released a security update to address three vulnerabilities affecting Citrix ADC and Citrix Gateway. CVE-2022-27510 is a Critical severity authentication bypass vulnerability, CVE-2022-27513 could allow remote desktop takeover via phishing, and CVE-2022-27516 is related to login brute force protection bypass.

An attacker could exploit some of these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Citrix Security Bulletin CTX463706 and apply the relevant updates.

Definitive source of threat updates

https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516

CVE Vulnerabilities

Status Published

CVE-2022-27510

Unauthorized access to Gateway user capabilities

Status Published

CVE-2022-27513

Remote desktop takeover via phishing

Status Published

CVE-2022-27516

User login brute force protection functionality bypass

Last edited: 9 November 2022 1:13 pm