Lucene search

[email protected]NVD:CVE-2020-8300

HistoryJun 16, 2021 - 2:15 p.m.

CVE-2020-8300

2021-06-1614:15:08

CWE-284

[email protected]

web.nvd.nist.gov

citrix

netscaler gateway

access control

saml authentication

hijack

phishing

user session

configuration

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

32.4%

JSON

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

Affected configurations

Nvd

Node

citrixgatewayRange12.1–12.1-62.23

citrixgatewayRange13.0–13.0-82.41

citrixnetscaler_gatewayRange11.1–11.1-65.20

Node

citrixapplication_delivery_controller_firmwareRange11.1–11.1-65.20

citrixapplication_delivery_controller_firmwareRange12.1–12.1-62.23

citrixapplication_delivery_controller_firmwareRange13.0–13.0-82.41

AND

citrixapplication_delivery_controllerMatch-

Node

citrixapplication_delivery_controller_firmwareRange12.1–12.1-55.238

AND

citrixmpx\/sdx_14030_fipsMatch-

citrixmpx\/sdx_14060_fipsMatch-

citrixmpx\/sdx_14080_fipsMatch-

citrixmpx_15030-50g_fipsMatch-

citrixmpx_15040-50g_fipsMatch-

citrixmpx_15060-50g_fipsMatch-

citrixmpx_15080-50g_fipsMatch-

citrixmpx_15100-50g_fipsMatch-

citrixmpx_15120-50g_fipsMatch-

citrixmpx_8905_fipsMatch-

citrixmpx_8910_fipsMatch-

citrixmpx_8920_fipsMatch-

VendorProductVersionCPE
citrixgateway*cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*
citrixnetscaler_gateway*cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
citrixapplication_delivery_controller_firmware*cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*
citrixapplication_delivery_controller-cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*
citrixmpx\/sdx_14030_fips-cpe:2.3:h:citrix:mpx\/sdx_14030_fips:-:*:*:*:*:*:*:*
citrixmpx\/sdx_14060_fips-cpe:2.3:h:citrix:mpx\/sdx_14060_fips:-:*:*:*:*:*:*:*
citrixmpx\/sdx_14080_fips-cpe:2.3:h:citrix:mpx\/sdx_14080_fips:-:*:*:*:*:*:*:*
citrixmpx_15030-50g_fips-cpe:2.3:h:citrix:mpx_15030-50g_fips:-:*:*:*:*:*:*:*
citrixmpx_15040-50g_fips-cpe:2.3:h:citrix:mpx_15040-50g_fips:-:*:*:*:*:*:*:*
citrixmpx_15060-50g_fips-cpe:2.3:h:citrix:mpx_15060-50g_fips:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
citrix	gateway	*	cpe:2.3:a:citrix:gateway::::::::
citrix	netscaler_gateway	*	cpe:2.3:a:citrix:netscaler_gateway::::::::
citrix	application_delivery_controller_firmware	*	cpe:2.3:o:citrix:application_delivery_controller_firmware::::::::
citrix	application_delivery_controller	-	cpe:2.3:h:citrix:application_delivery_controller:-:::::::*
citrix	mpx\/sdx_14030_fips	-	cpe:2.3:h:citrix:mpx\/sdx_14030_fips:-:::::::*
citrix	mpx\/sdx_14060_fips	-	cpe:2.3:h:citrix:mpx\/sdx_14060_fips:-:::::::*
citrix	mpx\/sdx_14080_fips	-	cpe:2.3:h:citrix:mpx\/sdx_14080_fips:-:::::::*
citrix	mpx_15030-50g_fips	-	cpe:2.3:h:citrix:mpx_15030-50g_fips:-:::::::*
citrix	mpx_15040-50g_fips	-	cpe:2.3:h:citrix:mpx_15040-50g_fips:-:::::::*
citrix	mpx_15060-50g_fips	-	cpe:2.3:h:citrix:mpx_15060-50g_fips:-:::::::*

Rows per page:

1-10 of 161

References

support.citrix.com/article/CTX297155

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

32.4%

JSON

Related for NVD:CVE-2020-8300

prion1 cve1 githubexploit1 cvelist1 citrix1 nessus1