Improper access control

2021-06-1614:15:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.4%

JSON

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

CPENameOperatorVersion
application_delivery_controller_firmwarege11.1
application_delivery_controller_firmwarelt11.1
application_delivery_controller_firmwarege12.1
application_delivery_controller_firmwarelt12.1
application_delivery_controller_firmwarege13.0
application_delivery_controller_firmwarelt13.0
application_delivery_controller_firmwarege12.1
application_delivery_controller_firmwarelt12.1
gatewayge12.1
gatewaylt12.1

Name	Operator	Version
application_delivery_controller_firmware	ge	11.1
application_delivery_controller_firmware	lt	11.1
application_delivery_controller_firmware	ge	12.1
application_delivery_controller_firmware	lt	12.1
application_delivery_controller_firmware	ge	13.0
application_delivery_controller_firmware	lt	13.0
application_delivery_controller_firmware	ge	12.1
application_delivery_controller_firmware	lt	12.1
gateway	ge	12.1
gateway	lt	12.1