Medium severity · published Jul 10, 2020
CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
In wildKEV
6.5
CVSS
88.3%
EPSS
Yes
On KEV
Description
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.3% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
CA
Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP ·
Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7 · source: vendor
AD
Application Delivery Controller Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30 · source: NVD
GF
Gateway Firmware · Citrix
13.0 before 13.0-58.30 · source: NVD
NG
Netscaler Gateway Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18 · source: NVD
SW
Sd-wan Wanop · Citrix
10.2 before 10.2.7; 11.0 before 11.0.3d; 11.1 before 11.1.1a · source: NVD
AD
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · Citrix
All versions, or not specified · source: KEV
Affected product
CA
Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8193
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://support.citrix.com/article/CTX276688
x_refsource_MISC
http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html
More from Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
6.5
CVE-2020-8195
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
4.3
CVE-2020-8196
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability