CVE-2021-22927
First published: Thu Aug 05 2021(Updated: )
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Citrix Netscaler Application Delivery Controller Firmware | >=11.1<11.1-65.22 | |
| Citrix Netscaler Application Delivery Controller Firmware | >=12.1<12.1-62.27 | |
| Citrix Netscaler Application Delivery Controller Firmware | >=13.0<13.0-82.45 | |
| Citrix Application Delivery Controller (ADC) and Gateway | ||
| Citrix Netscaler Application Delivery Controller Firmware | >=12.1<12.1-55.238 | |
| Citrix MPX/SDX 14030 FIPS | ||
| Citrix MPX/SDX 14060 FIPS | ||
| Citrix MPX/SDX 14080 FIPS | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix MPX | ||
| Citrix NetScaler Gateway | >=12.1<12.1-62.27 | |
| Citrix NetScaler Gateway | >=13.0<13.0-82.45 | |
| Citrix NetScaler Access Gateway | >=11.1<11.1-65.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-22927.
What is the severity of CVE-2021-22927?
The severity of CVE-2021-22927 is high (8.1).
What is the affected software for CVE-2021-22927?
The affected software for CVE-2021-22927 is Citrix ADC and Citrix Gateway 13.0-82.45.
What is the description of CVE-2021-22927?
CVE-2021-22927 is a session fixation vulnerability that exists in Citrix ADC and Citrix Gateway when configured as a SAML service provider, allowing an attacker to hijack a session.
How can I fix CVE-2021-22927?
To fix CVE-2021-22927, update Citrix ADC and Citrix Gateway to a version that is not affected by the vulnerability.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/citrix
- canonical/citrix netscaler application delivery controller firmware
- version/citrix netscaler application delivery controller firmware/11.1
- version/citrix netscaler application delivery controller firmware/12.1
- version/citrix netscaler application delivery controller firmware/13.0
- canonical/citrix application delivery controller (adc) and gateway
- canonical/citrix mpx/sdx 14030 fips
- canonical/citrix mpx/sdx 14060 fips
- canonical/citrix mpx/sdx 14080 fips
- canonical/citrix mpx
- canonical/citrix netscaler gateway
- version/citrix netscaler gateway/12.1
- version/citrix netscaler gateway/13.0
- canonical/citrix netscaler access gateway
- version/citrix netscaler access gateway/11.1