CVE-2023-24489criticalunder attackCWE-284

CVE-2023-24489: critical vulnerability in Citrix ShareFile Storage Zones Controller

Published · Updated

Follow this CVE+ Monitor ShareFile Storage Zones Controller+ Monitor Content Collaboration

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weaponsame day
Published on NVDJul 10
1st PoCJan 20
CISA KEV+37d
Action required by CISAfederal deadline: 2023-09-06

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An unauthenticated attacker can remotely compromise a customer-managed ShareFile storage zones controller without needing any credentials or authorization. This is critical because attackers can gain full control of the system and access sensitive files.

Technical detail

The vulnerability in the customer-managed ShareFile storage zones controller allows unauthenticated remote code execution due to improper access control (CWE-284). An attacker can exploit this without prior authentication to achieve complete system compromise and unrestricted access to stored data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Citrix · Citrix ShareFile Storage Zones Controller
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.