« Volver al listado

CVE-2021-22956

Estado: ModificadaAlta (7.5)—

An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Citrix — Application Delivery Controller FirmwareCitrix — GatewayCitrix — Sd-wan

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22956",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Citrix ADC, Citrix Gateway, Citrix SDWAN",
          "versions": [
            {
              "status": "affected",
              "version": "Citrix ADC 11.1,12.1,13.0,13.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-07T14:15:08.943",
  "references": [
    {
      "url": "https://support.citrix.com/article/CTX330728",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://support.citrix.com/article/CTX330728",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de consumo no controlado de recursos en Citrix ADC versiones anteriores a 13.0-83.27, versiones anteriores a 12.1-63.22 y 11.1-65.23 que podría permitir a un atacante con acceso a NSIP o SNIP con acceso a la interfaz de administración causar una interrupción temporal de la GUI de administración, la API Nitro y la comunicación RPC"
    }
  ],
  "lastModified": "2026-06-17T03:38:06.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFB94B59-4AA0-4144-B174-FFDD2EB9D2B4",
              "versionEndExcluding": "11.1-65.23"
            },
            {
              "criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C076C750-AC7C-48DD-86B2-EB69FA14467F",
              "versionEndExcluding": "12.1-63.22",
              "versionStartIncluding": "12.1"
            },
            {
              "criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2F3ACE6-B0F6-4E27-9DD8-EFEC98A7ACB4",
              "versionEndExcluding": "13.0-83.27",
              "versionStartIncluding": "13.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "80E69E10-6F40-4FE4-9D84-F6C25EAB79D8"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C7C2760-C923-4D70-B9BA-9905CBD7A72C",
              "versionEndExcluding": "11.1-65.23"
            },
            {
              "criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEC9E148-82D8-4032-9E30-3A40362FEF29",
              "versionEndExcluding": "12.1-63.22",
              "versionStartIncluding": "12.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1153F3C5-BEDB-4697-A57C-E0B5621ACC2A",
              "versionEndExcluding": "13.0-65.23",
              "versionStartIncluding": "13.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:sd-wan:*:*:*:*:wanop:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00C0944E-937D-42CD-A117-BB4ECAE52B61",
              "versionEndExcluding": "10.2.9c"
            },
            {
              "criteria": "cpe:2.3:a:citrix:sd-wan:*:*:*:*:wanop:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72E4366D-5278-45B1-8A14-0A3F7CD5F398",
              "versionEndExcluding": "11.4.2",
              "versionStartIncluding": "11.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}