Vulnerability · Published Aug 5, 2021 · Assigned by hackerone
CVE-2021-22920
Medium 6.5
In plain English
A medium-severity improper access control in Citrix ADC, Citrix Gateway. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Citrix ADC, Citrix Gateway | Citrix ADC and Citrix Gateway 13.0-82.45 and later releases of 13.0Citrix ADC and Citrix Gateway 12.1-62.27 and later releases of 12.1 |
Weakness: CWE-284
References
- https://support.citrix.com/article/CTX319135 x_refsource_MISC