CVE-2020-8300
Medium
Description
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Citrix Gateway
PublishedJun 16, 2021
First seenJun 16, 2021
Weakness typeCWE-284Improper access control
How to fix
Update
- citrix gateway12.1-62.23, 13.0-82.41 or later
- citrix netscaler_gateway11.1-65.20 or later
- citrix application_delivery_controller_firmware11.1-65.20, 12.1-62.23, 13.0-82.41, 12.1-55.238 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citrix gateway | 12.1 ≤ v < 12.1-62.23, 13.0 ≤ v < 13.0-82.41 | 12.1-62.23, 13.0-82.41 |
| citrix netscaler_gateway | 11.1 ≤ v < 11.1-65.20 | 11.1-65.20 |
| citrix application_delivery_controller_firmware | 11.1 ≤ v < 11.1-65.20, 12.1 ≤ v < 12.1-62.23, 13.0 ≤ v < 13.0-82.41, 12.1 ≤ v < 12.1-55.238 | 11.1-65.20, 12.1-62.23, 13.0-82.41, 12.1-55.238 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.