4.3

CVE-2020-8196

Warning

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Data is provided by the National Vulnerability Database (NVD)
Citrix ≫ Application Delivery Controller Firmware Version >= 10.5 < 10.5-70.18
Citrix ≫ Application Delivery Controller Firmware Version >= 11.1 < 11.1-64.14
Citrix ≫ Application Delivery Controller Firmware Version >= 12.0 < 12.0-63.21
Citrix ≫ Application Delivery Controller Firmware Version >= 12.1 < 12.1-57.18
Citrix ≫ Application Delivery Controller Firmware Version >= 13.0 < 13.0-58.30
Citrix ≫ Netscaler Gateway Firmware Version >= 10.5 < 10.5-70.18
   Citrix ≫ NetScaler Gateway Version-
Citrix ≫ Netscaler Gateway Firmware Version >= 11.1 < 11.1-64.14
   Citrix ≫ NetScaler Gateway Version-
Citrix ≫ Netscaler Gateway Firmware Version >= 12.0 < 12.0-63.21
   Citrix ≫ NetScaler Gateway Version-
Citrix ≫ Netscaler Gateway Firmware Version >= 12.1 < 12.1-57.18
   Citrix ≫ NetScaler Gateway Version-
Citrix ≫ Gateway Firmware Version >= 13.0 < 13.0-58.30
   Citrix ≫ Gateway Version-
Citrix ≫ Sd-wan Wanop Version >= 10.2 < 10.2.7
   Citrix ≫ 4000-wo Version-
   Citrix ≫ 4100-wo Version-
   Citrix ≫ 5000-wo Version-
   Citrix ≫ 5100-wo Version-
Citrix ≫ Sd-wan Wanop Version >= 11.0 < 11.0.3d
   Citrix ≫ 4000-wo Version-
   Citrix ≫ 4100-wo Version-
   Citrix ≫ 5000-wo Version-
   Citrix ≫ 5100-wo Version-
Citrix ≫ Sd-wan Wanop Version >= 11.1 < 11.1.1a
   Citrix ≫ 4000-wo Version-
   Citrix ≫ 4100-wo Version-
   Citrix ≫ 5000-wo Version-
   Citrix ≫ 5100-wo Version-

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Vulnerability

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 67.81% 0.985
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.