description: Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
defaultStatus: unaffected
product: NetScaler ADC
vendor: Cloud Software Group
versions:
lessThan: 12.35, status: affected, version: 14.1, versionType: patch
lessThan: 51.15, status: affected, version: 13.1, versionType: patch
lessThan: 92.21, status: affected, version: 13.0 , versionType: patch
lessThan: 37.176, status: affected, version:  13.1-FIPS, versionType: patch
lessThan: 55.302, status: affected, version: 12.1-FIPS, versionType: patch
lessThan: 55.302, status: affected, version: 12.1-NDcPP, versionType: patch
}
{
defaultStatus: unaffected
product: NetScaler Gateway
vendor: Cloud Software Group
versions:
lessThan: 12.35, status: affected, version: 14.1, versionType: patch
lessThan: 51.15, status: affected, version: 13.1, versionType: patch
lessThan: 92.21, status: affected, version: 13.0, versionType: patch
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL