Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
这是什么
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
CISA: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
该怎么做
Apply updates per vendor instructions.
美国联邦机构的修复期限：2022年5月3日
Citrix 的其他被利用漏洞
| 加入日期 | 漏洞 | 产品 | 严重程度 | 受攻击概率 |
|---|---|---|---|---|
| 2021年11月3日 | ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 中 6.5 | 33% |
| 2021年11月3日 | ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 中 4.3 | 26% |
| 2021年11月3日 | ADC, Gateway, and SD-WAN WANOP Appliance Code Execution | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 严重 9.8 | >99.9% |
| 2026年10月4日 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | 高 8.7 | 11% |
| 2026年9月27日 | Improper Input Validation | NetScaler | 严重 9.5 | 82% |
| 2026年9月27日 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | 严重 9.5 | 78% |
| 2026年9月9日 | Authentication Bypass Using an Alternate Path or Channel | NetScaler | 严重 9.3 | 33% |
| 2026年8月26日 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | 高 8.8 | 1.0% |
来源：Known Exploited Vulnerabilities（CISA，公有领域）、CVE records（cve.org）和 EPSS（FIRST）。受攻击概率是 EPSS 对未来 30 天内有人尝试利用该漏洞的估计。