CVE-2019-12989criticalunder attackCWE-89

CVE-2019-12989

Published · Updated

Follow this CVE+ Monitor SD-WAN and NetScaler

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 95%
from disclosure to weaponsame day
Published on NVDJul 16
1st PoCJul 12
CISA KEV+983d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Citrix SD-WAN and NetScaler SD-WAN versions before specific patches allow attackers to inject malicious SQL commands into the application, potentially exposing or modifying sensitive data stored in the database.

Technical detail

SQL Injection vulnerability in Citrix SD-WAN 10.2.x (before 10.2.3) and NetScaler SD-WAN 10.0.x (before 10.0.8) allows unauthenticated or low-privileged attackers to execute arbitrary SQL queries, enabling unauthorized data access, modification, or deletion. The attack vector is network-based with no user interaction required (CVSS 9.8).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.