Detections
Analytics
Citrix ADC and Citrix NetScaler Gateway Multiple Vulnerabilities (CTX297155)
medium Nessus Plugin ID 150866
Language:
Synopsis
The remote device is affected by multiple vulnerabilities.Description
The remote Citrix ADC or Citrix NetScaler Gateway device is version 11.1.x prior to 11.1-65.20, 12.1.x prior to 12.1-62.23, 12.1-FIPS prior to 12.1-55.238 or 13.0.x prior to 13.0-82.41. It is, therefore, affected by multiple vulnerabilities:- Network-based denial-of-service from within the same Layer 2 network segment (CVE-2020-8299)
- SAML authentication hijack through a phishing attack to steal a valid user session (CVE-2020-8300)
Please refer to advisory CTX297155 for more information.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
For versions 11.1.x, 12.1.x, 12.1-FIPS and 13.0.x, upgrade to 11.1-65.20, 12.1-62.23, 12.1-55.238-FIPS and 13.0-82.41, or later, respectively.See Also
Plugin Details
Severity: Medium
ID: 150866
File Name: citrix_netscaler_CTX297155.nasl
Version: 1.6
Type: combined
Family: CGI abuses
Published: 6/18/2021
Updated: 2/12/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2020-8300
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/h:citrix:netscaler_gateway, cpe:/h:citrix:netscaler_application_delivery_controller
Required KB Items: Host/NetScaler/Detected
Exploit Ease: No known exploits are available
Patch Publication Date: 6/8/2021
Vulnerability Publication Date: 6/8/2021
Reference Information
CVE: CVE-2020-8299, CVE-2020-8300