Medium severity · published Jul 10, 2020
CVE-2020-8195
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
In wildKEV
6.5
CVSS
33%
EPSS
Yes
On KEV
Description
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)33.0% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
CA
Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP ·
Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7 · source: vendor
AD
Application Delivery Controller Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30 · source: NVD
GF
Gateway Firmware · Citrix
13.0 before 13.0-58.30 · source: NVD
GP
Gateway Plug-in For Linux · Citrix
before 1.0.0.137 · source: NVD
NG
Netscaler Gateway Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18 · source: NVD
SW
Sd-wan Wanop · Citrix
10.2 before 10.2.7; 11.0 before 11.0.3d; 11.1 before 11.1.1a · source: NVD
AD
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · Citrix
All versions, or not specified · source: KEV
Affected product
CA
Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8195
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://support.citrix.com/article/CTX276688
x_refsource_MISC
http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html
More from Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
6.5
CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
4.3
CVE-2020-8196
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability