Micha Borrmann

The issue is related to insufficient session expiration, where tokens are not invalidated upon logout. This can potentially allow unauthorized access to user sessions.

The issue allows Information Exposure Through Caching. The `Via` header lists cache protocols and recipients between the start and end points for a request or a response. The `Age` header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive. Citrix disputes this as not a vulnerability, stating there is no sensitive information disclosure through the cache headers on Citrix ADC.

The issue concerns an Inconsistent Interpretation of HTTP Requests. It is noted that Citrix disputes the reported behavior as not a security issue, stating that Citrix ADC only caches HTTP/1.1 traffic for performance optimization.

The issue allows Cache Poisoning. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default. Citrix disputes this as not a vulnerability.

The issue allows Authentication Bypass via an Alternate Path or Channel.

The issue concerns reflected XSS in the login form.

The issue allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

The issue allows remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business. This is related to the SIP service in the affected devices.

The issue allows remote attackers to inject arbitrary web script or HTML via the URL, specifically in the homepage parameter of eintrag.php, potentially leading to cross-site scripting.