CVE-2020-8195
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
Description
CVE-2020-8195 is a MEDIUM-severity information disclosure vulnerability in Citrix ADC (Application Delivery Controller), Citrix Gateway, and Citrix SD-WAN WANOP appliance models, carrying a CVSS 3.1 score of 6.5. The vulnerability is caused by improper input validation that results in limited information disclosure to low-privileged users. Affected products include Citrix ADC firmware (versions 10.5 through 13.0), Citrix NetScaler Gateway firmware (versions 10.5 through 12.1), Citrix Gateway firmware (13.0), Citrix SD-WAN WANOP (versions 10.2 through 11.1), and Citrix Gateway Plug-in for Linux (before 1.0.0.137). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.73088 (98.77th percentile) reflects very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | application delivery controller firmware | >= 10.5, < 10.5-70.18; >= 11.1, < 11.1-64.14; >= 12.0, < 12.0-63.21; >= 12.1, < 12.1-57.18; >= 13.0, < 13.0-58.30 |
| citrix | netscaler gateway firmware | >= 10.5, < 10.5-70.18; >= 11.1, < 11.1-64.14; >= 12.0, < 12.0-63.21; >= 12.1, < 12.1-57.18 |
| citrix | gateway firmware | >= 13.0, < 13.0-58.30 |
| citrix | sd-wan wanop | >= 10.2, < 10.2.7; >= 11.0, < 11.0.3d; >= 11.1, < 11.1.1a |
| citrix | gateway plug-in for linux | < 1.0.0.137 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html(Exploit, Third Party Advisory, VDB Entry)
- https://support.citrix.com/article/CTX276688(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8195(US Government Resource)
Weakness Type
CWE-22: Path Traversal
CVE-2020-8195 is classified under CWE-20 — Improper Input Validation and CWE-22 — Path Traversal. Improper input validation occurs when a product fails to validate that input has the properties required for safe processing. Path traversal occurs when software uses external input to construct a pathname but fails to neutralize special elements that can cause the path to resolve outside the restricted directory.
In the context of Citrix ADC and Gateway, the improper input validation allows a low-privileged authenticated user to access information beyond their authorization level through path traversal techniques. This vulnerability is frequently exploited in combination with CVE-2020-8193 (authorization bypass), which provides the initial unauthenticated access. Together, these vulnerabilities allow an attacker to chain unauthenticated access into sensitive information disclosure from critical network infrastructure.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2020-8195 carries a CVSS 3.1 score of 6.5 (MEDIUM) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows a low-privileged user to access sensitive information through path traversal, including configuration files, internal network details, and potentially credentials stored on the Citrix appliance.
Integrity (NONE): The vulnerability does not allow modification of data on the affected system.
Availability (NONE): The vulnerability does not impact the availability of the affected device.
Scope Unchanged: The impact is contained within the vulnerable Citrix component, though the disclosed information may enable further attacks against other systems in the network.
With an EPSS score of 0.73088 (98.77th percentile), this vulnerability demonstrates very high real-world exploitation. The risk is amplified when combined with CVE-2020-8193 (authorization bypass) to form a complete exploit chain from unauthenticated access to sensitive information disclosure.
Exploit Maturity
CVE-2020-8195 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploits are available, including on PacketStorm. The vulnerability is most commonly exploited as part of a chain with CVE-2020-8193 (authorization bypass), where the attacker first gains unauthenticated access and then uses CVE-2020-8195 to exfiltrate sensitive data through path traversal.
Ransomware association: No direct ransomware association has been confirmed for CVE-2020-8195. However, the information obtained through exploitation can facilitate lateral movement and deeper network compromise that may lead to ransomware deployment.
Attack surface: The vulnerability affects Citrix ADC, Gateway, and SD-WAN WANOP appliances, as well as the Gateway Plug-in for Linux. While it requires low-privilege authentication, the companion vulnerability CVE-2020-8193 can provide the necessary access without credentials. The broad range of affected versions spans multiple major releases.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Organizations should address this vulnerability together with CVE-2020-8193 and CVE-2020-8196 from the same advisory.
Remediation
- Apply vendor patches immediately. Update to Citrix ADC 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, or 10.5-70.18. For SD-WAN WANOP, update to 11.1.1a, 11.0.3d, or 10.2.7. For Gateway Plug-in for Linux, update to 1.0.0.137 or later. Consult Citrix support article CTX276688.
- Address the complete vulnerability set. CVE-2020-8195 is commonly exploited alongside CVE-2020-8193 (authorization bypass) and CVE-2020-8196 (information disclosure). Ensure all three vulnerabilities are patched in your environment.
- Restrict management access. Limit access to the Citrix management interface to dedicated management networks. Implement network access controls and firewall rules to prevent unauthorized access.
- Audit user privileges. Review and minimize the privileges assigned to user accounts on Citrix appliances. Remove unnecessary accounts and ensure the principle of least privilege is enforced.
- Monitor for data exfiltration. Deploy monitoring to detect path traversal patterns in requests to Citrix appliances. Investigate any unusual file access patterns or information retrieval from the management interface.
- Rotate credentials after remediation. After patching, rotate credentials and secrets stored on or accessible from the Citrix appliance, as they may have been exposed through prior exploitation.
Technical Details
CVE-2020-8195 is a MEDIUM-severity information disclosure vulnerability exploitable over the network with low attack complexity. Low-level authentication is required but no user interaction is needed.
Technical mechanism: Citrix ADC and Gateway fail to properly validate input in certain management interface functions, allowing a low-privileged authenticated user to use path traversal techniques to access files and information outside their authorized scope. The vulnerability enables reading sensitive configuration data, internal files, and potentially credentials from the appliance. It is commonly combined with CVE-2020-8193, which provides unauthenticated access to the management interface.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): The network-based attack vector with low privileges required indicates the attacker needs basic authentication. The HIGH confidentiality impact reflects the significant amount of sensitive data accessible through the path traversal, while integrity and availability remain unaffected.
Affected products: Citrix ADC firmware (10.5 through 13.0), Citrix NetScaler Gateway firmware (10.5 through 12.1), Citrix Gateway firmware (13.0), Citrix SD-WAN WANOP (10.2 through 11.1), and Citrix Gateway Plug-in for Linux (before 1.0.0.137).
Frequently Asked Questions
Is CVE-2020-8195 being actively exploited?
Yes, CVE-2020-8195 is actively exploited in the wild, typically as part of a chain with CVE-2020-8193 (authorization bypass). The EPSS score of 0.73088 (98.77th percentile) confirms very high exploitation activity. The vulnerability is listed in CISA's KEV catalog.
What products are affected by CVE-2020-8195?
Citrix ADC firmware versions 10.5 through 13.0, Citrix NetScaler Gateway firmware versions 10.5 through 12.1, Citrix Gateway firmware 13.0, Citrix SD-WAN WANOP versions 10.2 through 11.1, and Citrix Gateway Plug-in for Linux before 1.0.0.137 are affected.
How do I fix CVE-2020-8195?
Apply the fixed firmware versions specified in Citrix support article CTX276688. Also patch CVE-2020-8193 and CVE-2020-8196 from the same advisory, as they are commonly exploited together. Restrict management interface access and rotate credentials after remediation.
How severe is CVE-2020-8195?
CVE-2020-8195 is rated MEDIUM with a CVSS 3.1 score of 6.5. While it requires low-level authentication on its own, it is typically chained with CVE-2020-8193 (which provides unauthenticated access) to achieve full unauthenticated information disclosure. The EPSS score of 0.73088 (98.77th percentile) confirms very high exploitation activity in the wild.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.