CVE-2021-22920 — Improper Access Control in Citrix Application Delivery Management

CWE-284 — Improper Access ControlCWE-384 — Session FixationCWE-400 — Uncontrolled Resource Consumption4 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 50.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
Citrix Application Delivery ManagementCitrix GatewayCitrix ADC+9 more
Timeline
PublishedAug 5
Latest updateMay 24

Description

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages12 packages

▶NVDcitrix/gateway12.1-62.25, 13.0-82.42+1

🔴Vulnerability Details

1
GHSA
GHSA-5w66-9x5w-m57v: A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citr↗2022-05-24
▶

📋Vendor Advisories

2
Citrix
CVE-2021-22920: A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citr↗2021-08-05
▶
Citrix
Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP Edition appliance Security Update↗2021-07-19
▶