Improper Input Validation in Citrix ADC and Gateway Software
CVE-2020-8195

6.5MEDIUM

Key Information:

Vendor
Citrix
Status
Citrix Adc, Citrix Gateway, Citrix Sdwan Wan-op
Vendor
CVE Published:
10 July 2020

Badges

👾 Exploit Exists🟣 EPSS 85%🦅 CISA Reported

Summary

This vulnerability stems from improper input validation in Citrix ADC and Citrix Gateway, allowing low privileged users to potentially gain limited access to sensitive information. The affected versions span across multiple iterations of both Citrix ADC and various Citrix SDWAN releases. Organizations using these products should evaluate their current deployments against the affected versions and apply recommended patches to mitigate security risks.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7

References

https://support.citrix.com/article/CTX276688
x_refsource_MISC
http://packetstormsecurity.com/files/160047/Citrix-ADC-Ne...
x_refsource_MISC

EPSS Score

85% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.