{"api_version":"1","generated_at":"2026-07-23T12:06:01+00:00","cve":"CVE-2009-2213","urls":{"html":"https://cve.report/CVE-2009-2213","api":"https://cve.report/api/cve/CVE-2009-2213.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-2213","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-2213"},"summary":{"title":"CVE-2009-2213","description":"The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-06-25 23:14:15","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-863","n/a"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.3","severity":"","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:N/A:N","baseScore":6.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51274","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51274","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.citrix.com/article/CTX118770","name":"http://support.citrix.com/article/CTX118770","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"],"title":"Weakness in the Default Configuration of NetScaler/Access Gateway Enterprise Edition Could Result in Unauthorized Access to Network Resources","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2009/1641","name":"http://www.vupen.com/english/advisories/2009/1641","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/35422","name":"http://www.securityfocus.com/bid/35422","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"Citrix NetScaler Access Gateway Default Configuration Unauthorized Access Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2213","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2213","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"2213","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"citrix","cpe5":"netscaler_access_gateway","cpe6":"-","cpe7":"-","cpe8":"enterprise","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2213","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_access_gateway_firmware","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2213","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_access_gateway_firmware","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2213","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_access_gateway_firmware","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2213","vulnerable":"1","versionEndIncluding":"8.1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_access_gateway_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:44:55.357Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"netscaler-default-unauth-access(51274)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51274"},{"name":"35422","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/35422"},{"name":"ADV-2009-1641","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/1641"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.citrix.com/article/CTX118770"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2009-2213","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-21T16:31:24.661375Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-21T16:31:37.448Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-05-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"netscaler-default-unauth-access(51274)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51274"},{"name":"35422","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/35422"},{"name":"ADV-2009-1641","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/1641"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.citrix.com/article/CTX118770"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-2213","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"netscaler-default-unauth-access(51274)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51274"},{"name":"35422","refsource":"BID","url":"http://www.securityfocus.com/bid/35422"},{"name":"ADV-2009-1641","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/1641"},{"name":"http://support.citrix.com/article/CTX118770","refsource":"CONFIRM","url":"http://support.citrix.com/article/CTX118770"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-2213","datePublished":"2009-06-25T21:00:00.000Z","dateReserved":"2009-06-25T00:00:00.000Z","dateUpdated":"2024-10-21T16:31:37.448Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-06-25 23:14:15","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-863","n/a"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:N/A:N","baseScore":6.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_access_gateway_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"8.1","matchCriteriaId":"FD2AF148-E1B5-427B-97E2-AEEC59D72162"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_access_gateway_firmware:7.0:*:*:*:*:*:*:*","matchCriteriaId":"DAA4BFC4-A82E-4820-AB97-2EF9D9EA9276"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_access_gateway_firmware:8.0:*:*:*:*:*:*:*","matchCriteriaId":"B80F696E-74A8-432C-BA31-6CE158B4DB82"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_access_gateway_firmware:9.0:*:*:*:*:*:*:*","matchCriteriaId":"CAD93B7C-E6C1-42F0-8963-C33EF0F6B88D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:citrix:netscaler_access_gateway:-:-:enterprise:*:*:*:*:*","matchCriteriaId":"4D5D5DFC-F456-4085-BE20-13BD38301B04"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"2213","Ordinal":"1","Title":"CVE-2009-2213","CVE":"CVE-2009-2213","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"2213","Ordinal":"1","NoteData":"The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions.","Type":"Description","Title":"CVE-2009-2213"},{"CveYear":"2009","CveId":"2213","Ordinal":"2","NoteData":"2009-06-25","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"2213","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}