CVE-2021-22927

Published: Aug 5, 2021Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Affected (7)

Products: Citrix: Application Delivery Controller Firmware, Gateway, Netscaler Gateway

Citrix

3 products

Application Delivery Controller Firmware

Gateway

Netscaler Gateway

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Citrix Application Delivery Controller Firmware	From 11.1 to 11.1-65.22
Citrix Application Delivery Controller Firmware	From 12.1 to 12.1-62.27
Citrix Application Delivery Controller Firmware	From 13.0 to 13.0-82.45

Running on/with	Platform Versions
Citrix Application Delivery Controller	All versions

Configuration B

1 vulnerable · 12 platform

Vulnerable Software	Affected Versions
Citrix Application Delivery Controller Firmware	From 12.1 to 12.1-55.238

Running on/with	Platform Versions
Citrix Mpx/sdx 14030 Fips	All versions
Citrix Mpx/sdx 14060 Fips	All versions
Citrix Mpx/sdx 14080 Fips	All versions
Citrix Mpx 15030 50g Fips	All versions
Citrix Mpx 15040 50g Fips	All versions
Citrix Mpx 15060 50g Fips	All versions
Citrix Mpx 15080 50g Fips	All versions
Citrix Mpx 15100 50g Fips	All versions
Citrix Mpx 15120 50g Fips	All versions
Citrix Mpx 8905 Fips	All versions
Citrix Mpx 8910 Fips	All versions
Citrix Mpx 8920 Fips	All versions

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Citrix Gateway	From 12.1 to 12.1-62.27
Citrix Gateway	From 13.0 to 13.0-82.45
Citrix Netscaler Gateway	From 11.1 to 11.1-65.22

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://support.citrix.com/article/CTX319135

Source: support@hackerone.com

Vendor Advisory

https://support.citrix.com/article/CTX319135

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.