CVE-2020-8193mediumunder attackCWE-284

CVE-2020-8193: medium-severity vulnerability in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP

Published · Updated

Follow this CVE+ Monitor NetScaler Gateway+ Monitor NetScaler ADC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.5epss 88%
from disclosure to weaponsame day
Published on NVDJul 10
1st PoCJul 10
CISA KEV+481d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Citrix ADC, Gateway, and SDWAN WAN-OP versions before specific patches allow unauthenticated users to access certain URL endpoints that should require authentication. This could let attackers view or interact with protected resources without logging in.

Technical detail

Improper access control (CWE-284) in multiple Citrix products enables unauthenticated access to specific URL endpoints due to missing or insufficient authentication checks. An unauthenticated attacker can directly access these endpoints over the network, potentially exposing sensitive information or administrative functions without valid credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
n/a · Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.