CVEvulnerability

CVE-2020-8193

6.5 MEDIUM Known exploited Published 2020-07-10 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability — Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-8193
Status
Analyzed
Published
2020-07-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-284, CWE-287

Description

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

Affected configurations

• citrix application delivery controller firmware (>= 10.5 < 10.5-70.18) • citrix application delivery controller firmware (>= 11.1 < 11.1-64.14) • citrix application delivery controller firmware (>= 12.0 < 12.0-63.21) • citrix application delivery controller firmware (>= 12.1 < 12.1-57.18) • citrix application delivery controller firmware (>= 13.0 < 13.0-58.30) • citrix netscaler gateway firmware (>= 10.5 < 10.5-70.18) • citrix netscaler gateway firmware (>= 11.1 < 11.1-64.14) • citrix netscaler gateway firmware (>= 12.0 < 12.0-63.21) • citrix netscaler gateway firmware (>= 12.1 < 12.1-57.18) • citrix gateway firmware (>= 13.0 < 13.0-58.30) • citrix sd-wan wanop (>= 10.2 < 10.2.7) • citrix sd-wan wanop (>= 11.0 < 11.0.3d) • citrix sd-wan wanop (>= 11.1 < 11.1.1a)

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-287 Improper Authentication weakness

References