NetScaler - Information Disclosure (CVE-2023-4966)
Description
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
psychologyCrowdSec Analysis
CVE-2023-4966 is a critical vulnerability in NetScaler ADC and NetScaler Gateway, which can lead to sensitive information disclosure when the system is configured as a gateway or virtual server.
CrowdSec has been tracking this vulnerability and its exploits since 4th of December 2024.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-4966 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-4966. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Observed exploitation attempts target URLs containing /oauth/idp/.well-known/openid-configuration.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-10-10 |
| CISA KEV | 2023-10-18 |
| CISA Remediation Deadline | 2023-11-08 |
| Rule Released | 2024-12-04 |
| CrowdSec First Seen | 2024-12-11 |