https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10110
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10111
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10112
No, ADC is not impacted by these CVEs
CVE-2020-10110
There is no sensitive information disclosure through the cache headers on Citrix ADC. The “Via” header lists cache protocols and recipients between the start and end points for a request or a response. The “Age” header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Age
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Via
CVE-2020-10111
Citrix ADC only caches HTTP/1.1 traffic for performance optimization. In conjunction with the response for CVE-2020-10112, the reported behavior is not considered a security issue.
CVE-2020-10112
By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which means those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default.