CVE-2021-22941criticalunder attackransomwareCWE-284

CVE-2021-22941: critical vulnerability in Citrix ShareFile storage zones controller

Published · Updated

Follow this CVE+ Monitor ShareFile Storage Zones Controller

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 54%
from disclosure to weapon19 days
Published on NVDSep 23
1st PoC+19d
CISA KEV+183d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Citrix ShareFile's storage zones controller has a flaw that allows someone without credentials to take over the system remotely. This is critical because attackers can gain full control without needing any password or authentication.

Technical detail

An improper access control vulnerability (CWE-284) in Citrix ShareFile storage zones controller versions before 5.11.20 allows unauthenticated remote attackers to compromise the affected system. The vulnerability requires no prior authentication or user interaction, enabling complete system takeover with CVSS 9.8 severity.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Citrix ShareFile storage zones controller
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.