Lucene search

[email protected]CVE-2020-8300

HistoryJun 16, 2021 - 2:15 p.m.

CVE-2020-8300

2021-06-1614:15:08

CWE-284

[email protected]

web.nvd.nist.gov

cve-2020-8300

citrix adc

citrix netscaler gateway

saml authentication

access control

phishing attack

user session

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

32.4%

JSON

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

Affected configurations

NVD

Node

citrixgatewayRange12.1–12.1-62.23

citrixgatewayRange13.0–13.0-82.41

citrixnetscaler_gatewayRange11.1–11.1-65.20

Node

citrixapplication_delivery_controller_firmwareRange11.1–11.1-65.20

citrixapplication_delivery_controller_firmwareRange12.1–12.1-62.23

citrixapplication_delivery_controller_firmwareRange13.0–13.0-82.41

AND

citrixapplication_delivery_controllerMatch-

Node

citrixapplication_delivery_controller_firmwareRange12.1–12.1-55.238

AND

citrixmpx\/sdx_14030_fipsMatch-

citrixmpx\/sdx_14060_fipsMatch-

citrixmpx\/sdx_14080_fipsMatch-

citrixmpx_15030-50g_fipsMatch-

citrixmpx_15040-50g_fipsMatch-

citrixmpx_15060-50g_fipsMatch-

citrixmpx_15080-50g_fipsMatch-

citrixmpx_15100-50g_fipsMatch-

citrixmpx_15120-50g_fipsMatch-

citrixmpx_8905_fipsMatch-

citrixmpx_8910_fipsMatch-

citrixmpx_8920_fipsMatch-

CPENameOperatorVersion
citrix:gatewaycitrix gatewaylt12.1-62.23
citrix:gatewaycitrix gatewaylt13.0-82.41
citrix:netscaler_gatewaycitrix netscaler gatewaylt11.1-65.20

CPE	Name	Operator	Version
citrix:gateway	citrix gateway	lt	12.1-62.23
citrix:gateway	citrix gateway	lt	13.0-82.41
citrix:netscaler_gateway	citrix netscaler gateway	lt	11.1-65.20

CNA Affected

[
  {
    "product": "Citrix ADC, Citrix Gateway",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238"
      }
    ]
  }
]

References

support.citrix.com/article/CTX297155

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

32.4%

JSON

Related for CVE-2020-8300

prion1 nvd1 githubexploit1 cvelist1 nessus1 citrix1