Vulnerability · Published Aug 5, 2021 · Assigned by hackerone
CVE-2021-22927
High 8.1
In plain English
A high-severity session fixation in Citrix ADC, Citrix Gateway. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Citrix ADC, Citrix Gateway | Citrix ADC and Citrix Gateway 13.0-82.45 and later releases of 13.0Citrix ADC and Citrix Gateway 12.1-62.27 and later releases of 12.1Citrix ADC and NetScaler Gateway 11.1-65.22 and later releases of 11.1Citrix ADC 12.1-FIPS 12.1-55.247 and later releases of 12.1-FIPS |
Weakness: CWE-384
References
- https://support.citrix.com/article/CTX319135 x_refsource_MISC