Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-8300: Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack...

CVE-2020-8300 · published 5 years ago

Summary

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must b...

What to do

Update citrix netscaler_gateway to version 11.1-65.20 or later.

Affected software

Vendor	Product	Affected versions
citrix	gateway	>= 12.1, < 12.1-62.23 >= 13.0, < 13.0-82.41 `cpe:2.3:a:citrix:gateway::::::::`
citrix	netscaler_gateway	>= 11.1, < 11.1-65.20 `cpe:2.3:a:citrix:netscaler_gateway::::::::`
citrix	application_delivery_controller_firmware	>= 11.1, < 11.1-65.20 >= 12.1, < 12.1-62.23 >= 13.0, < 13.0-82.41 >= 12.1, < 12.1-55.238 `cpe:2.3:o:citrix:application_delivery_controller_firmware::::::::`

Original advisory text

References

https://support.citrix.com/article/CTX297155 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published16 Jun 2021

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2020-8300 · NVD

Track software like this

Free during beta