Is ADC impacted by CVE-2020-10110, CVE-2020-10111 and CVE-2020-10112

Is ADC vulnerable to these CVEs recently discovered ?.

No, ADC is not impacted by these CVEs


There is no sensitive information disclosure through the cache headers on Citrix ADC. The “Via” header lists cache protocols and recipients between the start and end points for a request or a response. The “Age” header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive.


Citrix ADC only caches HTTP/1.1 traffic for performance optimization. In conjunction with the response for CVE-2020-10112, the reported behavior is not considered a security issue.


By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which means those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default.


Leave a Reply