# CVE-2023-4966: Unauthenticated sensitive information disclosure

> CVE-2023-4966 (GitHub advisory GHSA-2g42-2pwg-93cj) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.4, classed as Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119), in Citrix NetScaler ADC and Citrix NetScaler Gateway. No fixed version has been published yet. CISA lists it as a known exploited vulnerability (added 18 Oct 2023).

Canonical page: https://cveminer.com/vulnerabilities/CVE-2023-4966

| Field | Value |
| --- | --- |
| CVE | CVE-2023-4966 |
| GHSA | GHSA-2g42-2pwg-93cj |
| Severity | Critical |
| CVSS 3.1 | 9.4 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L` (GitHub Advisory Database) |
| CWE | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer |
| EPSS | 99.99% (higher than 99.9% of CVEs) |
| CISA KEV | Listed 18 Oct 2023, due 8 Nov 2023 |
| SSVC | exploitation active, automatable yes, technical impact total |
| Published | 10 Oct 2023 |
| Modified | 31 Jul 2026 |

## Description

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| Citrix NetScaler ADC | Vendor product | none | >= 14.1, < 8.50; >= 13.1, < 49.15; >= 13.0, < 92.19; >= 13.1-FIPS, < 37.164; >= 12.1-FIPS, < 55.300; >= 12.1-NDcPP, < 55.300 | no fix |
| Citrix NetScaler Gateway | Vendor product | none | >= 14.1, < 8.50; >= 13.1, < 49.15; >= 13.0, < 92.19 | no fix |

## Questions

**What is the GHSA ID for CVE-2023-4966?**

GitHub tracks CVE-2023-4966 as GHSA-2g42-2pwg-93cj.

**What is the CVSS score of CVE-2023-4966?**

CVE-2023-4966 has a CVSS 3.1 base score of 9.4 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

**Which versions are affected by CVE-2023-4966?**

Citrix NetScaler ADC (Vendor product): >= 14.1, < 8.50; >= 13.1, < 49.15; >= 13.0, < 92.19; >= 13.1-FIPS, < 37.164; >= 12.1-FIPS, < 55.300; >= 12.1-NDcPP, < 55.300. Citrix NetScaler Gateway (Vendor product): >= 14.1, < 8.50; >= 13.1, < 49.15; >= 13.0, < 92.19.

**How do I fix CVE-2023-4966?**

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

**Is CVE-2023-4966 exploited in the wild?**

CISA lists it as a known exploited vulnerability (added 18 Oct 2023). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-4966 (advisory)
- https://github.com/advisories/GHSA-2g42-2pwg-93cj (advisory)
- https://support.citrix.com/article/CTX579459
- http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2023-4966), compiled from GitHub Advisory Database, CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.