What’s Vulnerable › Vulnerabilities

CVE-2024-5492: Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-10 · updated 2026-06-17
• Weakness: CWE-601

Description

Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway

Affected products

• Citrix NetScaler ADC: from 12.1 before 13.0-92.31; from 13.1 before 13.1-53.17; from 14.1 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.17, 14.1-25.53
• Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.304; from 13.1 before 13.1-37.183 — fixed in 12.1-55.304, 13.1-37.183
• Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.304 — fixed in 12.1-55.304
• Citrix NetScaler Gateway: from 12.1 before 13.0-92.31; from 13.1 before 13.1-53.17; from 14.1 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.17, 14.1-25.53
• Citrix NetScaler ADC: from 14.1 before 14.1-25.53; from 13.1 before 13.1-53.17; from 13.0 before 13.0-92.31; from 13.1-FIPS before 13.1-37.183; from 12.1-FIPS before 12.1-55.304; from 12.1-NDcPP before 12.1-55.304 — fixed in 14.1-25.53, 13.1-53.17, 13.0-92.31, 13.1-37.183, 12.1-55.304
• Citrix NetScaler Gateway: from 14.1 before 14.1-25.53; from 13.1 before 13.1-53.17; from 13.0 before 13.0-92.31 — fixed in 14.1-25.53, 13.1-53.17, 13.0-92.31
• NetSclaer NetScaler ADC: from 14.1 before 25.53; from 13.1 before 53.17; from 13.0 before 92.13; from 13.1-FIPS before 37.183; from 12.1-FIPS before 55.304; from 12.1-NDcPP before 55.304 — fixed in 25.53, 53.17, 92.13, 37.183, 55.304

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.0-92.31, 13.1-53.17, 14.1-25.53; Citrix Netscaler Application Delivery Controller Fips 12.1-55.304, 13.1-37.183; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.304; Citrix NetScaler Gateway 13.0-92.31, 13.1-53.17, 14.1-25.53; Citrix NetScaler ADC 14.1-25.53, 13.1-53.17, 13.0-92.31, 13.1-37.183; Citrix NetScaler Gateway 14.1-25.53, 13.1-53.17, 13.0-92.31; NetSclaer NetScaler ADC 25.53, 53.17, 92.13, 37.183. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492
• https://support.citrix.com/external/article?articleUrl=CTX677944-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492
• https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492

Get alerted when CVE-2024-5492 or the next vulnerability affects your stack