CVE-2018-17448 Missing authorization in n/a

What is CVE-2018-17448?

CVE-2018-17448 is a critical missing authorization vulnerability in n/a, published on 23 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Incorrect Access Control issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.

Which versions are affected by CVE-2018-17448?

It affects 2 products.

Products include Citrix Netscaler Sd-Wan, Citrix Sd-Wan.

How do I fix CVE-2018-17448?

No fix has been published for CVE-2018-17448 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-17448 being exploited?

There is no known exploitation of CVE-2018-17448 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-12989 Citrix SD-WAN and NetScaler SQL Injection Exploited Critical 9.8
• CVE-2017-6316 Citrix Multiple Products Remote Code Execution Exploited Critical 9.8
• CVE-2019-12991 Citrix SD-WAN and NetScaler Command Injection Exploited High 8.8
• CVE-2019-12985 Command injection in n/a Critical 9.8
• CVE-2019-12986 Command injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p73q-qhqq-4f7g.