CVE-2020-8195
Published: 10 July 2020
Summary
CVE-2020-8195 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Citrix Application Delivery Controller Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-8195 is an improper input validation vulnerability, also referenced under CWE-20 and CWE-22, that affects Citrix ADC and Citrix Gateway versions prior to 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, and 10.5-70.18, as well as Citrix SD-WAN WAN-OP versions prior to 11.1.1a, 11.0.3d, and 10.2.7. The flaw permits limited information disclosure and has a CVSS v3.1 base score of 6.5 reflecting network attack vector, low attack complexity, and low privileges required.
Low-privileged authenticated users can exploit the issue over the network to read arbitrary files on affected appliances, consistent with local file inclusion behavior reported in public exploit archives. This results in high confidentiality impact without requiring user interaction or affecting integrity or availability.
Citrix advisory CTX276688 addresses the vulnerability and provides updated software builds that resolve the input validation weakness. The flaw is also listed in the CISA Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation activity against the affected Citrix products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-29072
Vulnerability details
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of input to block the path-traversal/file-inclusion payloads that enable arbitrary file reads.
Enforces access-control decisions so that low-privileged authenticated users cannot read files outside their authorized scope.
Mandates prompt installation of vendor patches that correct the input-validation flaw in the listed Citrix builds.