NetScaler Web Management Interface Cookie Credentials Encryption Weakness

medium Nessus Plugin ID 29220

Language:

Synopsis

The remote web server is prone to an information disclosure attack.

Description

The version of the Citrix NetScaler web management interface on the remote host uses weak encryption for protecting the HTTP cookie content by XORing sensitive values, including the username and password, with a fixed key stream.

Solution

Do not stay logged into the NetScaler web management interface while browsing other websites.

Plugin Details

Severity: Medium

ID: 29220

File Name: netscaler_web_cookie_crypto.nasl

Version: 1.14

Type: remote

Family: Web Servers

Published: 12/6/2007

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/a:citrix:netscaler

Required KB Items: www/netscaler, http/password

Reference Information

CVE: CVE-2007-6192

CWE: 310

Detections

Analytics