// For flags

CVE-2020-8982

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8983.

Existe un problema de lectura de archivos arbitrarios no autenticado en todas las versiones del controlador Citrix ShareFile StorageZones (también conocido como zonas de almacenamiento), incluidas las versiones más recientes de 5.10.x a partir de mayo de 2020. Se otorga acceso a archivos y RCE a todo lo alojado por ShareFile, ya sea en- local o dentro de Citrix Cloud (ambos tienen conexión a internet). NOTA: a diferencia de la mayoría de los CVE, la capacidad de explotación depende de la versión del producto que estaba en uso cuando se realizó un paso de configuración particular, NO de la versión del producto que está en uso durante una evaluación actual del inventario de productos de un consumidor de CVE. Específicamente, la vulnerabilidad puede explotarse si una de estas versiones del producto creó una zona de almacenamiento: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0 o anterior. Este CVE difiere de CVE-2020-7473 y CVE-2020-8983.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-02-13 CVE Reserved
  • 2020-05-07 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-11-03 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 <= 5.5.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version " <= 5.5.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.6.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.6.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.7.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.7.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.8.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.8.0"
-
Affected
Citrix
Search vendor "Citrix"
 Sharefile Storagezones Controller
Search vendor "Citrix" for product "Sharefile Storagezones Controller"
 5.9.0
Search vendor "Citrix" for product "Sharefile Storagezones Controller" and version "5.9.0"
-
Affected