CVE-2020-8300
Status: ModifiedMedium (6.5)—
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Base score: 6.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 3.00%
- Percentile among all scored CVEs: 87
- Score date: 10/1/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (3)
CWEs
- CWE-284
- NVD-CWE-Other
References
Raw JSON (NVD)
Show
{
"id": "CVE-2020-8300",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "support@hackerone.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Citrix ADC, Citrix Gateway",
"versions": [
{
"status": "affected",
"version": "Fixed in Citrix ADC and Citrix Gateway 13.0 before 13.0-82.41, Citrix ADC and Citrix Gateway 12.1 before 12.1-62.23, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238"
}
]
}
]
}
],
"published": "2021-06-16T14:15:08.440",
"references": [
{
"url": "https://support.citrix.com/article/CTX297155",
"tags": [
"Vendor Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://support.citrix.com/article/CTX297155",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "support@hackerone.com",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible."
},
{
"lang": "es",
"value": "Citrix ADC y Citrix/NetScaler Gateway versiones anteriores a 13.0-82.41, 12.1-62.23, 11.1-65.20 y Citrix ADC 12.1-FIPS versiones anteriores a 12.1-55.238, sufren de un control de acceso inapropiado que permite el secuestro de la autenticación SAML mediante un ataque de phishing para robar una sesión de usuario válida. Tome en cuenta que Citrix ADC o Citrix Gateway deben estar configurados como un SP SAML o un IdP SAML para que esto sea posible"
}
],
"lastModified": "2026-06-17T03:26:14.973",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "003574BC-2C37-44D6-9F5E-E931F5ECE169",
"versionEndExcluding": "12.1-62.23",
"versionStartIncluding": "12.1"
},
{
"criteria": "cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAE6C6C5-2C85-484E-A61A-C17096C4D9F7",
"versionEndExcluding": "13.0-82.41",
"versionStartIncluding": "13.0"
},
{
"criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D77B2AD2-BAF1-4FD3-B7C5-88AC1B130971",
"versionEndExcluding": "11.1-65.20",
"versionStartIncluding": "11.1"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E178AA28-B24F-4565-A314-1E58AAC54648",
"versionEndExcluding": "11.1-65.20",
"versionStartIncluding": "11.1"
},
{
"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "024F407E-F369-4B9C-BC3C-5CB0FF613526",
"versionEndExcluding": "12.1-62.23",
"versionStartIncluding": "12.1"
},
{
"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5675439-B8C6-4ABD-8D53-F2D9BB49F33D",
"versionEndExcluding": "13.0-82.41",
"versionStartIncluding": "13.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "80E69E10-6F40-4FE4-9D84-F6C25EAB79D8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BEBCAD2-581F-4217-8425-46C03584E673",
"versionEndExcluding": "12.1-55.238",
"versionStartIncluding": "12.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:citrix:mpx\\/sdx_14030_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BCB11BC1-0702-436F-BFE2-14B38B118D99"
},
{
"criteria": "cpe:2.3:h:citrix:mpx\\/sdx_14060_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8569B182-D0A7-414B-B0A3-4DD2FAB44F69"
},
{
"criteria": "cpe:2.3:h:citrix:mpx\\/sdx_14080_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ABB9B3E9-EED4-4D74-BE4C-DFAFAB1F0994"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_15030-50g_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F60729DF-EDC8-4462-ABD2-6E4199F22701"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_15040-50g_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B789F02A-56CB-4871-9D9D-FAB0F31A72A1"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_15060-50g_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "06699186-E7E4-463C-8844-77B2A750B985"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_15080-50g_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F00DBEBF-29BE-4D6A-BF79-19208AAB0D7F"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_15100-50g_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "848169A6-CAD7-4E14-BC5D-B2E94DC93CCB"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_15120-50g_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3C69709C-885A-4F19-899D-A7B5CE7066EF"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_8905_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6B2136C1-8AB6-4C70-87F4-1F8A93A876C9"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_8910_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "492323D2-339D-404C-BB9B-E09ABB87FA2B"
},
{
"criteria": "cpe:2.3:h:citrix:mpx_8920_fips:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AB83185D-DD6F-47CD-B500-499F9EF65093"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "support@hackerone.com"
}