CVE-2020-8300

🗓️ 16 Jun 2021 13:08:16Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 64 Views

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Improper Access Control in Citrix Gateway	15 Jun 202107:21	–	githubexploit
Circl	CVE-2020-8300	9 Oct 202417:28	–	circl
Tenable Nessus	Citrix ADC and Citrix NetScaler Gateway Multiple Vulnerabilities (CTX297155)	18 Jun 202100:00	–	nessus
CNNVD	Citrix Systems Citrix Application Delivery Controller 安全漏洞	9 Jun 202100:00	–	cnnvd
Citrix	Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP Edition appliance Security Update	8 Jun 202111:06	–	citrix
Citrix	Secure Hub shows an error and fails to connect after upgrading to a fixed firmware build to address CVE-2020-8299/ CVE-2020-8300	11 Jun 202100:00	–	citrix
Cvelist	CVE-2020-8300	16 Jun 202113:08	–	cvelist
NCSC	Vulnerabilities fixed in Citrix ADC and Citrix Gateway	8 Jun 202100:00	–	ncsc
NVD	CVE-2020-8300	16 Jun 202114:15	–	nvd
Prion	Improper access control	16 Jun 202114:15	–	prion

NVD

Node

citrix gatewayRange12.1–12.1-62.23

citrix gatewayRange13.0–13.0-82.41

citrix netscaler_gatewayRange11.1–11.1-65.20

Node

citrix application_delivery_controller_firmwareRange11.1–11.1-65.20

citrix application_delivery_controller_firmwareRange12.1–12.1-62.23

citrix application_delivery_controller_firmwareRange13.0–13.0-82.41

AND

citrix application_delivery_controllerMatch-

Node

citrix application_delivery_controller_firmwareRange12.1–12.1-55.238

AND

citrix mpx/sdx_14030_fipsMatch-

citrix mpx/sdx_14060_fipsMatch-

citrix mpx/sdx_14080_fipsMatch-

citrix mpx_15030-50g_fipsMatch-

citrix mpx_15040-50g_fipsMatch-

citrix mpx_15060-50g_fipsMatch-

citrix mpx_15080-50g_fipsMatch-

citrix mpx_15100-50g_fipsMatch-

citrix mpx_15120-50g_fipsMatch-

citrix mpx_8905_fipsMatch-

citrix mpx_8910_fipsMatch-

citrix mpx_8920_fipsMatch-

[
  {
    "product": "Citrix ADC, Citrix Gateway",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238"
      }
    ]
  }
]

Source	Link
support	www.support.citrix.com/article/CTX297155

21 Nov 2024 05:38Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

CVSS 3.16.5

EPSS0.14948

CWE-284