⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2020-8195 — Improper Input Validation in Citrix Application Delivery Controller Firmware

CWE-20 — Improper Input ValidationCWE-22 — Path Traversal21 documents10 sources
Severity
6.5MEDIUMNVD
EPSS
71.7%
top 1.26%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
13
Citrix Application Delivery Controller FirmwareCitrix Gateway FirmwareCitrix Gateway Plug-in FOR Linux+10 more
Timeline
PublishedJul 10
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages13 packages

▶NVDcitrix/gateway_plug-in< 1.0.0.137
▶NVDcitrix/gateway_firmware13.0 — 13.0-58.30
▶NVDcitrix/netscaler_gateway_firmware10.5 — 10.5-70.18+3

🔴Vulnerability Details

2
GHSA
GHSA-jwjc-9cxc-87j8: Improper input validation in Citrix ADC and Citrix Gateway versions before 13↗2022-05-24
▶
VulnCheck
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability↗2020
▶

💥Exploits & PoCs

1
Exploit-DB
Citrix ADC NetScaler - Local File Inclusion (Metasploit)↗2020-11-13
▶

🔍Detection Rules

2
Suricata
ET EXPLOIT Possible Citrix Authentication Bypass Attempt Inbound (CVE-2020-8193)↗2020-10-21
▶
Suricata
ET EXPLOIT Possible Citrix Information Disclosure Attempt Inbound (CVE-2020-8195)↗2020-10-21
▶

📋Vendor Advisories

3
CISA
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability↗2021-11-03
▶
Citrix
Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliance Security Update↗2020-08-17
▶
Citrix
CVE-2020-8195: Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SD↗2020-07-10
▶

🕵️Threat Intelligence

12
Tenable
Hold the Door: Why Organizations Need to Prioritize Patching SSL VPNs↗2021-08-25
▶
Tenable
One Year Later: What Can We Learn from Zerologon?↗2021-08-11
▶
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions↗2021-04-28
▶
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions↗2021-04-28
▶
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions↗2021-04-28
▶