CVE-2021-22927

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	Citrix ADC, Citrix Gateway	Citrix ADC and Citrix Gateway 13.0-82.45 and later releases of 13.0; Citrix ADC and Citrix Gateway 12.1-62.27 and later releases of 12.1; Citrix ADC and NetScaler Gateway 11.1-65.22 and later releases of 11.1; Citrix ADC 12.1-FIPS 12.1-55.247 and later releases of 12.1-FIPS

References

https://support.citrix.com/article/CTX319135Vendor Advisory
https://support.citrix.com/article/CTX319135Vendor Advisory

Timeline

Published: Aug 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-229287.8A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has eit CVE-2021-229296.1An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps o CVE-2021-22934.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-229309.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c CVE-2021-229319.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation CVE-2021-229327.5An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file CVE-2021-229336.5A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a m CVE-2021-229347.2A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device CVE-2021-229357.2A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanit CVE-2021-229366.1A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authentica CVE-2021-229377.2A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously c CVE-2021-229387.2A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanit