IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.5Media KEV

CVE-2020-8193Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP Publicada: (hace 6 años)

Explotación conocida — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

CISA confirmó el 03.11.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 03.05.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-8193

Descripción

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

Debilidad (CWE): CWE-284CWE-287

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
citrix application delivery controller firmware 10.5 – < 10.5-70.18
citrix gateway firmware 13.0 – < 13.0-58.30
citrix netscaler gateway firmware 10.5 – < 10.5-70.18
citrix sd-wan wanop 10.2 – < 10.2.7
— Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7

Referencias y parches

Coincidencias CPE (NVD) (13)
  • cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* ≥ 10.5 < 10.5-70.18
  • cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* ≥ 11.1 < 11.1-64.14
  • cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* ≥ 12.0 < 12.0-63.21
  • cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* ≥ 12.1 < 12.1-57.18
  • cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* ≥ 13.0 < 13.0-58.30
  • cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:* ≥ 10.5 < 10.5-70.18
  • cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:* ≥ 11.1 < 11.1-64.14
  • cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:* ≥ 12.0 < 12.0-63.21
  • cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:* ≥ 12.1 < 12.1-57.18
  • cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:* ≥ 13.0 < 13.0-58.30
  • cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:* ≥ 10.2 < 10.2.7
  • cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:* ≥ 11.0 < 11.0.3d
  • cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:* ≥ 11.1 < 11.1.1a

CVE recientes del mismo producto — Citrix NetScaler ADC / Gateway

8.8Alta
CVE-2026-88778

TCP Initial Sequence Number (ISN) prediction

Citrix NetScaler ADC; Citrix NetScaler Gateway

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1…