{"id":"CVE-2023-3466","published":"2023-07-19T18:21:05Z","modified":"2024-10-21T21:09:28Z","title":"Reflected Cross-Site Scripting (XSS)","vendor":"Citrix","product":"NetScaler ADC ","tier":"core","eol":null,"affectedVersions":[{"vendor":"Citrix","product":"NetScaler ADC ","versions":[">= 13.1, < 49.13",">= 13.0, < 91.13",">= 13.1-FIPS, < 37.159",">= 12.1-FIPS, < 55.297",">= 12.1-NDcPP, < 55.297"]},{"vendor":"Citrix","product":"NetScaler Gateway","versions":[">= 13.1, < 49.13",">= 13.0, < 91.13"]}],"description":{"text":"Reflected Cross-Site Scripting (XSS)\n","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02629,"percentile":0.85471,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-31","exploitedFirstSeen":"2024-01-31","ransomware":false,"evidence":[{"url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","date":"2024-01-31"},{"url":"https://www.cisa.gov/sites/default/files/2024-11/aa24-317a-2023-top-routinely-exploited-vulnerabilities.pdf","date":"2024-11-12"},{"url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19"},{"url":"https://horizon3.ai/intelligence/blogs/from-patch-tuesday-to-pentest-wednesday-how-a-global-chemical-manufacturer-de-risked-a-2b-merger/","date":"2025-10-15"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","url":"https://otx.alienvault.com/pulse/67440c6c49e3680d57b29290","created":"2024-11-25"},{"name":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","url":"https://otx.alienvault.com/pulse/673ec88967c80a1f2767bb3a","created":"2024-11-21"},{"name":"Spot the Difference: Earth Kasha&#39;s New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella | Trend Micro (US)","url":"https://otx.alienvault.com/pulse/673c82cbbf082b90bbae2d49","created":"2024-11-19"},{"name":"Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","url":"https://otx.alienvault.com/pulse/673c582be52f89fb7bcd8a59","created":"2024-11-19"},{"name":"Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells | CISA","url":"https://otx.alienvault.com/pulse/64d0bd4146099d65cddfbcc1","created":"2023-08-07"},{"name":"Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells | CISA","url":"https://otx.alienvault.com/pulse/64d09dd4b50ecb4b950db1df","created":"2023-08-07"},{"name":"Threat Brief: RCE Vulnerability CVE-2023-3519 on Customer-Managed Citrix Servers","url":"https://otx.alienvault.com/pulse/64cb264b88cebe1ecc36d70f","created":"2023-08-03"},{"name":"Threat Brief: RCE Vulnerability CVE-2023-3519 on Customer-Managed Citrix Servers","url":"https://otx.alienvault.com/pulse/64c9e39a743ff437fab9d14e","created":"2023-08-02"},{"name":"Dark Web Profile: 8Base Ransomware","url":"https://otx.alienvault.com/pulse/64c3b8a568674f257291b042","created":"2023-07-28"},{"name":"Advisory Report for Zero-Day in Citrix ADC and Gateway Vulnerability (Updated)","url":"https://otx.alienvault.com/pulse/64c0b4920a40bb8a96162adc","created":"2023-07-26"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467","tags":[]}],"techniques":[],"reports":[{"id":"SRC-d849a763c1dde7c77634","title":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19","mentions":[{"quote":"LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.","start":27361,"end":27552}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-44127","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44127","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-3466","provenance":"source"},{"date":"2024-01-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","provenance":"source"},{"date":"2024-11-19","kind":"report","label":"Named in trendmicro.com: Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The…","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":64.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1002 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.09,"detail":"percentile 0.8547"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":5.81,"detail":"base score 8.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}