← Back

CVE-2020-8195

nvd nist
Published: Jul 10, 2020Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Affected (14)

Citrix
5 products
Application Delivery Controller Firmware
Netscaler Gateway Firmware
Gateway Firmware
Sd Wan Wanop
Gateway Plug In For Linux
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Citrix
Application Delivery Controller Firmware
From 10.5 to 10.5-70.18
Application Delivery Controller Firmware
From 11.1 to 11.1-64.14
Application Delivery Controller Firmware
From 12.0 to 12.0-63.21
Application Delivery Controller Firmware
From 12.1 to 12.1-57.18
Application Delivery Controller Firmware
From 13.0 to 13.0-58.30
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Citrix
Netscaler Gateway Firmware
From 10.5 to 10.5-70.18
Netscaler Gateway Firmware
From 11.1 to 11.1-64.14
Netscaler Gateway Firmware
From 12.0 to 12.0-63.21
Netscaler Gateway Firmware
From 12.1 to 12.1-57.18
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Gateway Firmware
From 13.0 to 13.0-58.30
Configuration D
3 vulnerable · 4 platform
Vulnerable SoftwareAffected Versions
Citrix
Sd Wan Wanop
From 10.2 to 10.2.7
Sd Wan Wanop
From 11.0 to 11.0.3d
Sd Wan Wanop
From 11.1 to 11.1.1a
Running on/withPlatform Versions
Citrix
4000 Wo
All versions
Citrix
4100 Wo
All versions
Citrix
5000 Wo
All versions
Citrix
5100 Wo
All versions
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Gateway Plug In For Linux
Before 1.0.0.137

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (5)

Source: support@hackerone.com
ExploitThird Party AdvisoryVDB Entry
Source: support@hackerone.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.