CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to…

published April 3, 2015

CVSS
—
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01987 · 80.5th percentile
Published
2015-04-03T14:00Z
EPSS history
Timeline
  • 03 APR 14:00Z
    The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to…
    cvelistv5