cbcvebase.
CVE-2020-8245
published 2020-09-18

CVE-2020-8245: Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC…

PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.93%
56.3th percentile
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b leads to an HTML Injection attack against the SSL VPN web portal.

Affected

15 ranges
VendorProductVersion rangeFixed in
citrixapplication_delivery_controller_firmware>= 11.1 < 11.1-65.1211.1-65.12
citrixapplication_delivery_controller_firmware>= 12.1 < 12.1-58.1512.1-58.15
citrixapplication_delivery_controller_firmware>= 13.0 < 13.0-64.3513.0-64.35
citrixcitrix_adc
citrixcitrix_application_delivery_controller
citrixcitrix_gateway
citrixcitrix_sd-wan_wanop
citrixgateway>= 11.1 < 11.1-65.1211.1-65.12
citrixgateway>= 13.0 < 13.0-64.3513.0-64.35
citrixnetscaler_adc
citrixnetscaler_adc_gateway
citrixnetscaler_gateway
citrixnetscaler_gateway>= 12.1 < 12.1-58.1512.1-58.15
citrixsd-wan
citrixxenserver

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.