CVE-2020-8247 Privilege escalation in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP

What is CVE-2020-8247?

CVE-2020-8247 is a high-severity vulnerability in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP, published on 18 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b are vulnerable to escalation of privileges on the management interface.

Weakness: CWE-269

Which versions are affected by CVE-2020-8247?

It affects 4 products.

Products include Citrix Application Delivery Controller Firmware, Citrix Gateway, Citrix Netscaler Gateway, Citrix Sd-Wan Wanop.

How do I fix CVE-2020-8247?

No fix has been published for CVE-2020-8247 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-8247 being exploited?

There is no known exploitation of CVE-2020-8247 in the wild and no public exploit code.

Other vulnerabilities in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP

• CVE-2022-27518 Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Exploited Critical 9.8
• CVE-2019-19781 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Exploited Critical 9.8
• CVE-2020-8193 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Exploited Medium 6.5
• CVE-2020-8195 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Exploited Medium 6.5
• CVE-2020-8196 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Exploited Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3fgp-p3x8-6r59.