CVE-2020-8195: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Vulnerability summary

CVE-2020-8195 is a medium (CVSS 6.5) Improper Input Validation vulnerability in Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 33.03% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-07-2020
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVCitrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
3. 03-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.