CVE-2014-4346

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-16 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

Citrix Netscaler Access Gateway: all versions
Citrix Netscaler Access Gateway Firmware: 10.1 (and their updates)
Citrix NetScaler ADC: all versions
Citrix Netscaler Application Delivery Controller Firmware: 10.1 (and their updates)

References

http://seclists.org/fulldisclosure/2014/Jul/77
http://secunia.com/advisories/59942
http://support.citrix.com/article/CTX140863
http://www.securityfocus.com/archive/1/532802/100/0/threaded
http://www.securityfocus.com/bid/68535
http://www.securitytracker.com/id/1030572
http://www.securitytracker.com/id/1030573
https://exchange.xforce.ibmcloud.com/vulnerabilities/94493
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_Citrix_NetScaler_Multiple_Vulnerabilities_v10.txt
http://seclists.org/fulldisclosure/2014/Jul/77
http://secunia.com/advisories/59942
http://support.citrix.com/article/CTX140863

Get alerted when CVE-2014-4346 or the next vulnerability affects your stack