| The "applianceSettingsFileTransfer" action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. Affected Products are NetScaler SD-WAN 9.x, NetScaler SD-WAN 10.0.x before 10.0.8, Citrix SD-WAN 10.1.x, Citrix SD-WAN 10.2.x before 10.2.3. |
