CVE-2020-8300

2021-06-1613:08:16

CWE-284

hackerone

www.cve.org

citrix adc

netscaler gateway

saml authentication

hijack vulnerability

phishing attack

valid user session

access control

EPSS

0.001

Percentile

32.4%

JSON

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

CNA Affected

[
  {
    "product": "Citrix ADC, Citrix Gateway",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238"
      }
    ]
  }
]

References

support.citrix.com/article/CTX297155

EPSS

0.001

Percentile

32.4%

JSON

Related for CVELIST:CVE-2020-8300