// For flags

CVE-2020-7473

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, allow unauthenticated attackers to access the documents and folders of ShareFile users. NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-8982 and CVE-2020-8983 but has essentially the same risk.

En determinadas situaciones, todas las versiones del Controlador de Citrix ShareFile StorageZones (también se conoce como storage zones), incluidas las versiones 5.10.x más recientes a partir de Mayo de 2020, permiten a atacantes no autenticados acceder a los documentos y carpetas de los usuarios de ShareFile. NOTA: a diferencia de la mayoría de los CVE, la explotabilidad depende de la versión del producto que estaba en uso cuando un paso de configuración particular fue realizado, NO de la versión del producto que está en uso durante una evaluación actual del inventario de productos de un consumidor de CVE. Específicamente, la vulnerabilidad puede ser explotada si una zona de almacenamiento fue creada por una de estas versiones del producto: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0 o anterior. Este CVE difiere de CVE-2020-8982 y CVE-2020-8983, pero tiene esencialmente el mismo riesgo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-21 CVE Reserved
  • 2020-05-07 CVE Published
  • 2022-06-18 First Exploit
  • 2024-05-31 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 <= 5.5.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version " <= 5.5.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.6.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.6.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.7.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.7.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.8.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.8.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.9.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.9.0"
-
Affected