CVE-2020-8196

Katalog CVE

CVSS 4.3 · Medium KEV · sudah dieksploitasi EPSS 26,3%

Kerentanan Improper Access Control pada citrix application delivery controller firmware, citrix netscaler gateway firmware +2 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Rincian

Terbit di NVD

10 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-287: Improper Authentication

EPSS (30 hari)

26,3% peluang dieksploitasi; lebih tinggi dari 97,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.citrix.com/article/CTX276688 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8196 pemerintah AS
• http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html advisory pihak ketiga · vdb entry