sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2021-22956 Denial of service in Citrix ADC, Citrix Gateway, Citrix SDWAN

High 7.5 Published Updated

An attacker with management interface access can cause temporary disruption of the Citrix ADC management GUI, API, and RPC communication.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2021-22956?

CVE-2021-22956 is a high-severity denial of service vulnerability in Citrix ADC, Citrix Gateway, Citrix SDWAN, published on 7 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication.

Weakness: CWE-400

Which versions are affected by CVE-2021-22956?

It affects 3 products.

Products include Citrix Application Delivery Controller Firmware, Citrix Gateway, Citrix Sd-Wan.

How do I fix CVE-2021-22956?

No fix has been published for CVE-2021-22956 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-22956 being exploited?

There is no known exploitation of CVE-2021-22956 in the wild and no public exploit code.

Sources

Also known as GHSA-cvqf-ghwg-56gj.

Is CVE-2021-22956 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free