{"api_version":"1","generated_at":"2026-07-23T12:02:45+00:00","cve":"CVE-2017-17549","urls":{"html":"https://cve.report/CVE-2017-17549","api":"https://cve.report/api/cve/CVE-2017-17549.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-17549","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-17549"},"summary":{"title":"CVE-2017-17549","description":"Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-12-13 16:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://support.citrix.com/article/ctx230612","name":"https://support.citrix.com/article/ctx230612","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Information Disclosure in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Client TLS Handshake","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/102177","name":"http://www.securityfocus.com/bid/102177","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Multiple Citrix Products CVE-2017-17549 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1040011","name":"http://www.securitytracker.com/id/1040011","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Citrix NetScaler ADC and Gateway Packet Engine TLS Handshake Flaw Lets Remote Users Obtain Cleartext in Certain Cases - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17549","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17549","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"application_delivery_controller_firmware","cpe6":"10.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"application_delivery_controller_firmware","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"application_delivery_controller_firmware","cpe6":"11.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"application_delivery_controller_firmware","cpe6":"12.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_gateway_firmware","cpe6":"10.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_gateway_firmware","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_gateway_firmware","cpe6":"11.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17549","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"citrix","cpe5":"netscaler_gateway_firmware","cpe6":"12.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"17549","cve":"CVE-2017-17549","epss":"0.006380000","percentile":"0.707120000","score_date":"2026-05-18","updated_at":"2026-05-19 00:10:21"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T20:51:32.066Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1040011","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1040011"},{"name":"102177","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/102177"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.citrix.com/article/ctx230612"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-12-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-12-14T10:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1040011","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1040011"},{"name":"102177","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/102177"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.citrix.com/article/ctx230612"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-17549","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1040011","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1040011"},{"name":"102177","refsource":"BID","url":"http://www.securityfocus.com/bid/102177"},{"name":"https://support.citrix.com/article/ctx230612","refsource":"CONFIRM","url":"https://support.citrix.com/article/ctx230612"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2017-17549","datePublished":"2017-12-13T16:00:00.000Z","dateReserved":"2017-12-11T00:00:00.000Z","dateUpdated":"2024-08-05T20:51:32.066Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-12-13 16:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:application_delivery_controller_firmware:10.5:*:*:*:*:*:*:*","matchCriteriaId":"D56F2AAF-4658-484C-9A3A-D8A52BA5B10C"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:application_delivery_controller_firmware:11.0:*:*:*:*:*:*:*","matchCriteriaId":"3CE459BE-DA8F-4DFB-B901-5F294C6311F7"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:application_delivery_controller_firmware:11.1:*:*:*:*:*:*:*","matchCriteriaId":"8CE9E655-0D97-4DCF-AC2F-79DCD12770E5"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:application_delivery_controller_firmware:12.0:*:*:*:*:*:*:*","matchCriteriaId":"49454F7D-77B5-46DF-B95C-312AF2E68EAD"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_gateway_firmware:10.5:*:*:*:*:*:*:*","matchCriteriaId":"7E0FA8E2-3E8F-481E-8C39-FB00A9739DFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_gateway_firmware:11.0:*:*:*:*:*:*:*","matchCriteriaId":"D2C6F82C-9969-4A6E-88C8-AB8BB0AAD3C7"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_gateway_firmware:11.1:*:*:*:*:*:*:*","matchCriteriaId":"A5D73B9A-59AA-4A38-AEAF-7EAB0965CD7E"},{"vulnerable":true,"criteria":"cpe:2.3:o:citrix:netscaler_gateway_firmware:12.0:*:*:*:*:*:*:*","matchCriteriaId":"B9F3ED0E-7F3D-477B-B645-77DA5FC7F502"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"17549","Ordinal":"1","Title":"CVE-2017-17549","CVE":"CVE-2017-17549","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"17549","Ordinal":"1","NoteData":"Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange.","Type":"Description","Title":"CVE-2017-17549"},{"CveYear":"2017","CveId":"17549","Ordinal":"2","NoteData":"2017-12-13","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"17549","Ordinal":"3","NoteData":"2017-12-14","Type":"Other","Title":"Modified"}]}}}