CVE-2021-22927: 
NixOS vulnerability analysis and mitigation

A session fixation vulnerability (CVE-2021-22927) was discovered in Citrix ADC and Citrix Gateway version 13.0-82.45 when configured as a SAML service provider. The vulnerability was initially recorded on January 6, 2021, and was publicly disclosed in August 2021 (CVE MITRE, NVD).

The vulnerability is classified as CWE-384 (Session Fixation) and received a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The CVSS v2.0 score is 5.8 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:P/I:P/A:N). The vulnerability requires user interaction for successful exploitation (NVD).

If successfully exploited, this vulnerability could allow an attacker to hijack a user's session, potentially leading to unauthorized access to sensitive information and system resources (NVD).

Citrix has released security updates to address this vulnerability. The fixed versions include ADC and Gateway versions 13.0-82.45 and later, 12.1-62.27 and later, and 11.1-65.22 and later (Citrix Advisory).