CVE-2020-8245 Cross-site scripting in Citrix ADC, Citrix Gateway

Medium 6.1 Published 18 Sep 2020 Updated 4 Aug 2024

Attackers can inject HTML into the SSL VPN web portal, potentially leading to session hijacking or malicious script execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-8245?

CVE-2020-8245 is a medium-severity cross-site scripting vulnerability in Citrix ADC, Citrix Gateway, published on 18 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b leads to an HTML Injection attack against the SSL VPN web portal.

Weakness: CWE-79

Which versions are affected by CVE-2020-8245?

It affects 3 products.

Products include Citrix Application Delivery Controller Firmware, Citrix Gateway, Citrix Netscaler Gateway.

How do I fix CVE-2020-8245?

No fix has been published for CVE-2020-8245 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-8245 being exploited?

There is no known exploitation of CVE-2020-8245 in the wild and no public exploit code.

Sources

Also known as GHSA-62vx-hh36-4mpq.