CVE-2020-8300

MEDIUM

6.5

CVSS Score

Published: June 16, 2021 at 01:08 PM UTC

Updated: June 17, 2026 at 03:26 AM UTC

16 products affected across 1 vendorNetScaler GatewayGatewayApplication Delivery Controller Firmware

Using Citrix ADC, Citrix Gateway by N/A?

Get instant alerts when new vulnerabilities affect Citrix ADC, Citrix Gateway - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 3%

Description

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Application Delivery Controller Firmware · Citrix

95%

11.1 ≤ v < 11.1-65.2012.1 ≤ v < 12.1-55.23812.1 ≤ v < 12.1-62.2313.0 ≤ v < 13.0-82.41

Affected range stops below 11.1-65.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1-55.238, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1-62.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.0-82.41, so it looks safe — our inference, not a vendor statement

citrix-mpx-15030-50g-fips (environment) · citrix-mpx-15040-50g-fips (environment) · citrix-mpx-15060-50g-fips (environment) · citrix-mpx-15080-50g-fips (environment) · citrix-mpx-15100-50g-fips (environment) · citrix-mpx-15120-50g-fips (environment) · citrix-mpx-8905-fips (environment) · citrix-mpx-8910-fips (environment) · citrix-mpx-8920-fips (environment) · citrix-mpx-sdx-14030-fips (environment) · citrix-mpx-sdx-14060-fips (environment) · citrix-mpx-sdx-14080-fips (environment) · citrix-application-delivery-controller (same device)

Gateway · Citrix

95%

v < 13.0-82.4112.1 ≤ v < 12.1-62.2313.0 ≤ v < 13.0-82.41

Affected range stops below 12.1-62.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.0-82.41, so it looks safe — our inference, not a vendor statement

NetScaler Gateway · Citrix

95%

11.1 ≤ v < 11.1-65.20

Affected range stops below 11.1-65.20, so it looks safe — our inference, not a vendor statement

Application Delivery Controller · Citrix

60%

v < 13.0-82.41