{"id":"CVE-2023-3467","published":"2023-07-19T18:35:56Z","modified":"2024-10-24T17:43:49Z","title":"Privilege Escalation to root administrator (nsroot)","vendor":"Citrix","product":"NetScaler ADC ","tier":"core","eol":null,"affectedVersions":[{"vendor":"Citrix","product":"NetScaler ADC ","versions":[">= 13.1, < 49.13",">= 13.0, < 91.13",">= 13.1-FIPS, < 37.159",">= 12.1-FIPS, < 55.297",">= 12.1-NDcPP, < 55.297"]},{"vendor":"Citrix","product":"NetScaler Gateway","versions":[">= 13.1, < 49.13",">= 13.0, < 91.13"]}],"description":{"text":"Privilege Escalation to root administrator (nsroot)\n","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01305,"percentile":0.7046,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-31","exploitedFirstSeen":"2024-01-31","ransomware":false,"evidence":[{"url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","date":"2024-01-31"},{"url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19"},{"url":"https://horizon3.ai/intelligence/blogs/from-patch-tuesday-to-pentest-wednesday-how-a-global-chemical-manufacturer-de-risked-a-2b-merger/","date":"2025-10-15"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","url":"https://otx.alienvault.com/pulse/67440c6c49e3680d57b29290","created":"2024-11-25"},{"name":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","url":"https://otx.alienvault.com/pulse/673ec88967c80a1f2767bb3a","created":"2024-11-21"},{"name":"Spot the Difference: Earth Kasha&#39;s New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella | Trend Micro (US)","url":"https://otx.alienvault.com/pulse/673c82cbbf082b90bbae2d49","created":"2024-11-19"},{"name":"Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","url":"https://otx.alienvault.com/pulse/673c582be52f89fb7bcd8a59","created":"2024-11-19"},{"name":"Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells | CISA","url":"https://otx.alienvault.com/pulse/64d0bd4146099d65cddfbcc1","created":"2023-08-07"},{"name":"Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells | CISA","url":"https://otx.alienvault.com/pulse/64d09dd4b50ecb4b950db1df","created":"2023-08-07"},{"name":"Threat Brief: RCE Vulnerability CVE-2023-3519 on Customer-Managed Citrix Servers","url":"https://otx.alienvault.com/pulse/64cb264b88cebe1ecc36d70f","created":"2023-08-03"},{"name":"Threat Brief: RCE Vulnerability CVE-2023-3519 on Customer-Managed Citrix Servers","url":"https://otx.alienvault.com/pulse/64c9e39a743ff437fab9d14e","created":"2023-08-02"},{"name":"Dark Web Profile: 8Base Ransomware","url":"https://otx.alienvault.com/pulse/64c3b8a568674f257291b042","created":"2023-07-28"},{"name":"Advisory Report for Zero-Day in Citrix ADC and Gateway Vulnerability (Updated)","url":"https://otx.alienvault.com/pulse/64c0b4920a40bb8a96162adc","created":"2023-07-26"}],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467","tags":[]}],"techniques":[],"reports":[{"id":"SRC-d849a763c1dde7c77634","title":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19","mentions":[{"quote":"LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.","start":27361,"end":27552}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-44128","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44128","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-3467","provenance":"source"},{"date":"2024-01-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","provenance":"source"},{"date":"2024-11-19","kind":"report","label":"Named in trendmicro.com: Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The…","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":60.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1002 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.09,"detail":"percentile 0.7046"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":5.6,"detail":"base score 8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}