CVE-2020-8191: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2020-8191 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Citrix ADC (Application Delivery Controller), Citrix Gateway, and Citrix SDWAN WAN-OP products. The vulnerability was discovered in early 2020 and affects multiple versions of these products before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18, and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 (NVD, CVE).

The vulnerability is caused by improper input validation in the affected Citrix products. It has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 Base Score is 4.3 (Medium) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N) (NVD).

The vulnerability allows an unauthenticated remote user to perform a reflected Cross-Site Scripting (XSS) attack. However, successful exploitation requires a victim who must open an attacker-controlled link in the browser while being on a network with connectivity to the NSIP (NetScaler IP) (Citrix Blog).

The vulnerability requires specific conditions for exploitation. An attacker must convince a victim to open a malicious link while connected to a network with NSIP access. At the time of disclosure, Citrix was not aware of any active exploitation of this vulnerability in the wild (Citrix Blog).

Citrix has released patches to address this vulnerability. Users are advised to upgrade to the following versions: 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, and 10.5-70.18 for Citrix ADC and Gateway, and versions 11.1.1a, 11.0.3d, and 10.2.7 for SDWAN WAN-OP (NVD).