Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2020-8300 Details
Description
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.citrix.com/article/CTX297155 | CVE | Vendor Advisory |
| https://support.citrix.com/article/CTX297155 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| citrix gateway | >= 12.1, < 12.1-62.23 >= 13.0, < 13.0-82.41 |
CPE
Remediation
| |
| citrix netscaler gateway | >= 11.1, < 11.1-65.20 |
CPE
Remediation
| |
| citrix application delivery controller firmware | >= 11.1, < 11.1-65.20 >= 12.1, < 12.1-62.23 >= 13.0, < 13.0-82.41 >= 12.1, < 12.1-55.238 |
CPE
Remediation
| |
| citrix application delivery controller | All versions |
CPE
Remediation
| |
| citrix mpx/sdx 14030 fips | All versions |
CPE
Remediation
| |
| citrix mpx/sdx 14060 fips | All versions |
CPE
Remediation
| |
| citrix mpx/sdx 14080 fips | All versions |
CPE
Remediation
| |
| citrix mpx 15030-50g fips | All versions |
CPE
Remediation
| |
| citrix mpx 15040-50g fips | All versions |
CPE
Remediation
| |
| citrix mpx 15060-50g fips | All versions |
CPE
Remediation
| |
| citrix mpx 15080-50g fips | All versions |
CPE
Remediation
| |
| citrix mpx 15100-50g fips | All versions |
CPE
Remediation
| |
| citrix mpx 15120-50g fips | All versions |
CPE
Remediation
| |
| citrix mpx 8905 fips | All versions |
CPE
Remediation
| |
| citrix mpx 8910 fips | All versions |
CPE
Remediation
| |
| citrix mpx 8920 fips | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Sep 20, 2022 | Reanalysis | [email protected] |
| Jun 24, 2021 | Initial Analysis | [email protected] |