Medium severity · published Jul 10, 2020
CVE-2020-8191
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before…
6.1
CVSS
23.5%
EPSS
No
On KEV
Description
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)23.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Application Delivery Controller Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30 · source: NVD
GF
Gateway Firmware · Citrix
13.0 before 13.0-58.30 · source: NVD
NG
Netscaler Gateway Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18 · source: NVD
SW
Sd-wan Wanop · Citrix
10.2 before 10.2.7; 11.0 before 11.0.3d; 11.1 before 11.1.1a · source: NVD
Affected product
AD
Application Delivery Controller Firmware
Citrix
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8191
Vendor Advisory
https://support.citrix.com/article/CTX276688
More from Application Delivery Controller Firmware
9.8
CVE-2022-27518
Unauthenticated remote arbitrary code execution
9.8
CVE-2019-19781
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
6.5
CVE-2020-8195
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
6.5
CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
4.3
CVE-2020-8196
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability