CVE-2021-22927: 
NixOS vulnerability analysis and mitigation

A session fixation vulnerability (CVE-2021-22927) was discovered in Citrix ADC and Citrix Gateway version 13.0-82.45 when configured as a SAML service provider. The vulnerability was initially recorded on January 6, 2021, and was publicly disclosed in August 2021 (CVE MITRE, NVD).

The vulnerability is classified as CWE-384 (Session Fixation) and received a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The CVSS v2.0 score is 5.8 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:P/I:P/A:N). The vulnerability requires user interaction for successful exploitation (NVD).

If successfully exploited, this vulnerability could allow an attacker to hijack a user's session, potentially leading to unauthorized access to sensitive information and system resources (NVD).

The vulnerability requires network access and user interaction for successful exploitation. The attack complexity is considered low according to the CVSS metrics, indicating that the vulnerability is relatively straightforward to exploit under the right conditions (NVD).

Citrix has released security updates to address this vulnerability. The fixed versions include ADC and Gateway versions 13.0-82.45 and later, 12.1-62.27 and later, and 11.1-65.22 and later (Citrix Advisory).