CVE-2020-8191

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-07-10 · updated 2026-06-17
Weakness: CWE-79

Description

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).

Affected products

Citrix Application Delivery Controller Firmware: from 10.5 before 10.5-70.18; from 11.1 before 11.1-64.14; from 12.0 before 12.0-63.21; from 12.1 before 12.1-57.18; from 13.0 before 13.0-58.30 — fixed in 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18, 13.0-58.30
Citrix Gateway Firmware: from 13.0 before 13.0-58.30 — fixed in 13.0-58.30
Citrix Netscaler Gateway Firmware: from 10.5 before 10.5-70.18; from 11.1 before 11.1-64.14; from 12.0 before 12.0-63.21; from 12.1 before 12.1-57.18 — fixed in 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18
Citrix Sd-Wan Wanop: from 10.2 before 10.2.7; from 11.0 before 11.0.3d; from 11.1 before 11.1.1a — fixed in 10.2.7, 11.0.3d, 11.1.1a
Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP: Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller Firmware 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18; Citrix Gateway Firmware 13.0-58.30; Citrix Netscaler Gateway Firmware 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18; Citrix Sd-Wan Wanop 10.2.7, 11.0.3d, 11.1.1a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8191 or the next vulnerability affects your stack