Actively exploited in the wild
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
Citrix - Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-8196
MediumCVSS 4.3KEVSummary
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
Risk Assessment
Low privileged users could access sensitive information, potentially leading to further attacks.
Recommendation
Update Citrix ADC and Citrix Gateway to version 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18 or later, and Citrix SDWAN WAN-OP to version 11.1.1a, 11.0.3d, 10.2.7 or later.
Other vulnerabilities in Citrix ADC
Original NVD description (English source)
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.