CVE-2019-19781

UNKNOWN

Published 2019-12-27T13:06:46.000Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2019-19781. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

9.8

/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.945

probability

of exploitation in the wild

There is a 94.5% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 1.000

Higher than 100.0% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Description

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Available Exploits

Citrix ADC and Gateway - Directory Traversal

Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities.

ID: CVE-2019-19781

Author: organiccrapgeeknik Critical

References:

Related News

No news articles found for this CVE.

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

May 3, 2022

Added to KEV

November 3, 2021

Required Action

Apply updates per vendor instructions.

Affected Product

Vendor/Project: Citrix

Product: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Ransomware Risk

Known Ransomware Use

KEV Catalog Version: 2025.01.24 Released: January 24, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-jjcm-f6q3-w5xj

Advisory Details

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-19781

WEB https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781

WEB https://forms.gle/eDf3DXZAv96oosfj6

WEB https://support.citrix.com/article/CTX267027

WEB https://twitter.com/bad_packets/status/1215431625766424576

WEB https://www.kb.cert.org/vuls/id/619785

WEB http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html

WEB http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html

WEB http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html

WEB http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html

WEB http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: February 4, 2025

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

1 post

Reddit • 1 month, 1 week ago

Immediate_Gold9789

Exploit PoC Payload

🔥 Most Brutal VPN Exploits Exposed — A Technical Breakdown By CyberDudeBivash – Ruthless, Engineering-Grade Threat Intel https://preview.redd.it/kmgikig5tsjf1.png?width=1536&format=png&auto=webp&s=8a0dc329b5e31ebb657f9e2b65d1e37721ff9ab6 # 1. Introduction Virtual Private Networks (VPNs) are the **backbone of remote access security**, yet they remain **prime targets** for advanced persistent threats (APTs) and ransomware groups. Over the last decade, **VPN …