CVE-2019-12989: Citrix SD-WAN and NetScaler SQL Injection Vulnerability

Q: What is the severity of CVE-2019-12989?

The severity of CVE-2019-12989 is critical with a score of 9.8.

Q: What is the affected software for CVE-2019-12989?

The affected software for CVE-2019-12989 is Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8.

Q: What is SQL Injection vulnerability?

SQL Injection vulnerability is a code injection technique where an attacker can insert malicious SQL statements into an application's database query.

Q: How can I fix CVE-2019-12989?

To fix CVE-2019-12989, upgrade your Citrix SD-WAN to version 10.2.3 or later, and upgrade your NetScaler SD-WAN to version 10.0.8 or later.

Q: Where can I find more information about CVE-2019-12989?

You can find more information about CVE-2019-12989 in the following references: [http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html](http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html), [http://www.securityfocus.com/bid/109133](http://www.securityfocus.com/bid/109133), [https://support.citrix.com/article/CTX251987](https://support.citrix.com/article/CTX251987).

Published Jul 16, 2019

Updated

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Other sources

Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.

— CISA

Affected Software

3 affected components

Citrix SD-WAN and NetScaler

Citrix NetScaler SD-WAN>=10.0.0<10.0.8

Citrix SD-WAN>=10.2.0<10.2.3

Event History

Jul 16, 2019

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Mar 25, 2022

Known Exploited

via CISA·12:00 AM

Frequently Asked Questions

What is the severity of CVE-2019-12989?

The severity of CVE-2019-12989 is critical with a score of 9.8.

What is the affected software for CVE-2019-12989?

The affected software for CVE-2019-12989 is Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8.

What is SQL Injection vulnerability?

SQL Injection vulnerability is a code injection technique where an attacker can insert malicious SQL statements into an application's database query.

How can I fix CVE-2019-12989?

To fix CVE-2019-12989, upgrade your Citrix SD-WAN to version 10.2.3 or later, and upgrade your NetScaler SD-WAN to version 10.0.8 or later.

Where can I find more information about CVE-2019-12989?

You can find more information about CVE-2019-12989 in the following references: [http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html](http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html), [http://www.securityfocus.com/bid/109133](http://www.securityfocus.com/bid/109133), [https://support.citrix.com/article/CTX251987](https://support.citrix.com/article/CTX251987).