CVE-2020-8300 - Vulnerability Details

Vendors	Products
Citrix	Application Delivery Controller Application Delivery Controller Firmware Gateway Mpx\/sdx 14030 Fips Mpx\/sdx 14060 Fips Mpx\/sdx 14080 Fips Mpx 15030-50g Fips Mpx 15040-50g Fips Mpx 15060-50g Fips Mpx 15080-50g Fips Mpx 15100-50g Fips Mpx 15120-50g Fips Mpx 8905 Fips Mpx 8910 Fips Mpx 8920 Fips Netscaler Gateway

Link	Providers
https://support.citrix.com/article/CTX297155

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Citrix ADC, Citrix Gateway", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238"}]}], "descriptions": [{"lang": "en", "value": "Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "Improper Access Control - Generic (CWE-284)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-06-16T13:08:16", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.citrix.com/article/CTX297155"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2020-8300", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Citrix ADC, Citrix Gateway", "version": {"version_data": [{"version_value": "Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Access Control - Generic (CWE-284)"}]}]}, "references": {"reference_data": [{"name": "https://support.citrix.com/article/CTX297155", "refsource": "MISC", "url": "https://support.citrix.com/article/CTX297155"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:56:28.314Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.citrix.com/article/CTX297155"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2020-8300", "datePublished": "2021-06-16T13:08:16", "dateReserved": "2020-01-28T00:00:00", "dateUpdated": "2024-08-04T09:56:28.314Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Citrix ADC, Citrix Gateway (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-284 (string)

description : Improper Access Control - Generic (CWE-284) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-06-16T13:08:16 (string)

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://support.citrix.com/article/CTX297155 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : support@hackerone.com (string)

ID : CVE-2020-8300 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Citrix ADC, Citrix Gateway (string)

version : { »

version_data : [ »

0 : { »

version_value : Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238 (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Improper Access Control - Generic (CWE-284) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://support.citrix.com/article/CTX297155 (string)

refsource : MISC (string)

url : https://support.citrix.com/article/CTX297155 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T09:56:28.314Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://support.citrix.com/article/CTX297155 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

assignerShortName : hackerone (string)

cveId : CVE-2020-8300 (string)

datePublished : 2021-06-16T13:08:16 (string)

dateReserved : 2020-01-28T00:00:00 (string)

dateUpdated : 2024-08-04T09:56:28.314Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "003574BC-2C37-44D6-9F5E-E931F5ECE169", "versionEndExcluding": "12.1-62.23", "versionStartIncluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAE6C6C5-2C85-484E-A61A-C17096C4D9F7", "versionEndExcluding": "13.0-82.41", "versionStartIncluding": "13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "D77B2AD2-BAF1-4FD3-B7C5-88AC1B130971", "versionEndExcluding": "11.1-65.20", "versionStartIncluding": "11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E178AA28-B24F-4565-A314-1E58AAC54648", "versionEndExcluding": "11.1-65.20", "versionStartIncluding": "11.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "024F407E-F369-4B9C-BC3C-5CB0FF613526", "versionEndExcluding": "12.1-62.23", "versionStartIncluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5675439-B8C6-4ABD-8D53-F2D9BB49F33D", "versionEndExcluding": "13.0-82.41", "versionStartIncluding": "13.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "80E69E10-6F40-4FE4-9D84-F6C25EAB79D8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8BEBCAD2-581F-4217-8425-46C03584E673", "versionEndExcluding": "12.1-55.238", "versionStartIncluding": "12.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:citrix:mpx\\/sdx_14030_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "BCB11BC1-0702-436F-BFE2-14B38B118D99", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx\\/sdx_14060_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "8569B182-D0A7-414B-B0A3-4DD2FAB44F69", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx\\/sdx_14080_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "ABB9B3E9-EED4-4D74-BE4C-DFAFAB1F0994", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_15030-50g_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "F60729DF-EDC8-4462-ABD2-6E4199F22701", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_15040-50g_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "B789F02A-56CB-4871-9D9D-FAB0F31A72A1", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_15060-50g_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "06699186-E7E4-463C-8844-77B2A750B985", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_15080-50g_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "F00DBEBF-29BE-4D6A-BF79-19208AAB0D7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_15100-50g_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "848169A6-CAD7-4E14-BC5D-B2E94DC93CCB", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_15120-50g_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C69709C-885A-4F19-899D-A7B5CE7066EF", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_8905_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "6B2136C1-8AB6-4C70-87F4-1F8A93A876C9", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_8910_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "492323D2-339D-404C-BB9B-E09ABB87FA2B", "vulnerable": false}, {"criteria": "cpe:2.3:h:citrix:mpx_8920_fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "AB83185D-DD6F-47CD-B500-499F9EF65093", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible."}, {"lang": "es", "value": "Citrix ADC y Citrix/NetScaler Gateway versiones anteriores a 13.0-82.41, 12.1-62.23, 11.1-65.20 y Citrix ADC 12.1-FIPS versiones anteriores a 12.1-55.238, sufren de un control de acceso inapropiado que permite el secuestro de la autenticaci\u00f3n SAML mediante un ataque de phishing para robar una sesi\u00f3n de usuario v\u00e1lida. Tome en cuenta que Citrix ADC o Citrix Gateway deben estar configurados como un SP SAML o un IdP SAML para que esto sea posible"}], "id": "CVE-2020-8300", "lastModified": "2024-11-21T05:38:41.320", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-06-16T14:15:08.440", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://support.citrix.com/article/CTX297155"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.citrix.com/article/CTX297155"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "support@hackerone.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 003574BC-2C37-44D6-9F5E-E931F5ECE169 (string)

versionEndExcluding : 12.1-62.23 (string)

versionStartIncluding : 12.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FAE6C6C5-2C85-484E-A61A-C17096C4D9F7 (string)

versionEndExcluding : 13.0-82.41 (string)

versionStartIncluding : 13.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D77B2AD2-BAF1-4FD3-B7C5-88AC1B130971 (string)

versionEndExcluding : 11.1-65.20 (string)

versionStartIncluding : 11.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E178AA28-B24F-4565-A314-1E58AAC54648 (string)

versionEndExcluding : 11.1-65.20 (string)

versionStartIncluding : 11.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 024F407E-F369-4B9C-BC3C-5CB0FF613526 (string)

versionEndExcluding : 12.1-62.23 (string)

versionStartIncluding : 12.1 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A5675439-B8C6-4ABD-8D53-F2D9BB49F33D (string)

versionEndExcluding : 13.0-82.41 (string)

versionStartIncluding : 13.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 80E69E10-6F40-4FE4-9D84-F6C25EAB79D8 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8BEBCAD2-581F-4217-8425-46C03584E673 (string)

versionEndExcluding : 12.1-55.238 (string)

versionStartIncluding : 12.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:citrix:mpx\/sdx_14030_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BCB11BC1-0702-436F-BFE2-14B38B118D99 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:citrix:mpx\/sdx_14060_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8569B182-D0A7-414B-B0A3-4DD2FAB44F69 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:citrix:mpx\/sdx_14080_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : ABB9B3E9-EED4-4D74-BE4C-DFAFAB1F0994 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:citrix:mpx_15030-50g_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F60729DF-EDC8-4462-ABD2-6E4199F22701 (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:citrix:mpx_15040-50g_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B789F02A-56CB-4871-9D9D-FAB0F31A72A1 (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:citrix:mpx_15060-50g_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 06699186-E7E4-463C-8844-77B2A750B985 (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:citrix:mpx_15080-50g_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F00DBEBF-29BE-4D6A-BF79-19208AAB0D7F (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:citrix:mpx_15100-50g_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 848169A6-CAD7-4E14-BC5D-B2E94DC93CCB (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:citrix:mpx_15120-50g_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3C69709C-885A-4F19-899D-A7B5CE7066EF (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:citrix:mpx_8905_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6B2136C1-8AB6-4C70-87F4-1F8A93A876C9 (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:citrix:mpx_8910_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 492323D2-339D-404C-BB9B-E09ABB87FA2B (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:citrix:mpx_8920_fips:-:*:*:*:*:*:*:* (string)

matchCriteriaId : AB83185D-DD6F-47CD-B500-499F9EF65093 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible. (string)

}

1 : { »

lang : es (string)

value : Citrix ADC y Citrix/NetScaler Gateway versiones anteriores a 13.0-82.41, 12.1-62.23, 11.1-65.20 y Citrix ADC 12.1-FIPS versiones anteriores a 12.1-55.238, sufren de un control de acceso inapropiado que permite el secuestro de la autenticación SAML mediante un ataque de phishing para robar una sesión de usuario válida. Tome en cuenta que Citrix ADC o Citrix Gateway deben estar configurados como un SP SAML o un IdP SAML para que esto sea posible (string)

}

]

id : CVE-2020-8300 (string)

lastModified : 2024-11-21T05:38:41.320 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-06-16T14:15:08.440 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.citrix.com/article/CTX297155 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.citrix.com/article/CTX297155 (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-284 (string)

}

]

source : support@hackerone.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-Other (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object