CVE-2023-24488: Cross site scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-10 · updated 2026-06-17
Weakness: CWE-79

Description

Cross site scripting vulnerability in Citrix ADC and Citrix Gateway  in allows and attacker to perform cross site scripting

Affected products

Citrix Application Delivery Controller: from 12.1 before 12.1-65.35; from 13.0 before 13.0-90.11; from 13.1 before 13.1-45.61 — fixed in 12.1-65.35, 13.0-90.11, 13.1-45.61
Citrix Application Delivery Controller Fips: from 12.1 before 12.1-55.296 — fixed in 12.1-55.296
Citrix Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.296 — fixed in 12.1-55.296
NetScaler Gateway: from 12.1 before 12.1-65.35; from 13.0 before 13.0-90.11; from 13.1 before 13.1-45.61 — fixed in 12.1-65.35, 13.0-90.11, 13.1-45.61
Citrix ADC and Citrix Gateway: from 13.1 before 13.1-45.61; from 13.0 before 13.0-90.11; from 12.1 before 12.1-65.35; from 12.1-FIPS before 12.1-55.296; from 13.1-FIPS before 13.1-37.150; from 12.1-NDcPP before 12.1-55.296 — fixed in 13.1-45.61, 13.0-90.11, 12.1-65.35, 12.1-55.296, 13.1-37.150

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller 12.1-65.35, 13.0-90.11, 13.1-45.61; Citrix Application Delivery Controller Fips 12.1-55.296; Citrix Application Delivery Controller Ndcpp 12.1-55.296; NetScaler Gateway 12.1-65.35, 13.0-90.11, 13.1-45.61; Citrix ADC and Citrix Gateway 13.1-45.61, 13.0-90.11, 12.1-65.35, 12.1-55.296. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24488 or the next vulnerability affects your stack