{"id":"CVE-2023-3467","published":"2023-07-19T18:35:56Z","modified":"2024-10-24T17:43:49Z","title":"Privilege Escalation to root administrator (nsroot)","vendor":"Citrix","product":"NetScaler ADC ","tier":"core","eol":null,"affectedVersions":[{"vendor":"Citrix","product":"NetScaler ADC ","versions":[">= 13.1, < 49.13",">= 13.0, < 91.13",">= 13.1-FIPS, < 37.159",">= 12.1-FIPS, < 55.297",">= 12.1-NDcPP, < 55.297"]},{"vendor":"Citrix","product":"NetScaler Gateway","versions":[">= 13.1, < 49.13",">= 13.0, < 91.13"]}],"description":{"text":"Privilege Escalation to root administrator (nsroot)\n","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01305,"percentile":0.7054,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-31","exploitedFirstSeen":"2024-01-31","ransomware":false,"evidence":[{"url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","date":"2024-01-31"},{"url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19"},{"url":"https://horizon3.ai/intelligence/blogs/from-patch-tuesday-to-pentest-wednesday-how-a-global-chemical-manufacturer-de-risked-a-2b-merger/","date":"2025-10-15"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467","tags":[]}],"techniques":[],"reports":[{"id":"SRC-d849a763c1dde7c77634","title":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19","mentions":[{"quote":"LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.","start":27361,"end":27552}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-44128","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44128","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-3467","provenance":"source"},{"date":"2024-01-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","provenance":"source"},{"date":"2024-11-19","kind":"report","label":"Named in trendmicro.com: Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The…","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":58.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1005 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.11,"detail":"percentile 0.7054"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.6,"detail":"base score 8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}